I have a wireguard VPN, I want to make it so a specific client/peer can only access one internal IP/port on the local network

I tried this in my ufw config, but my client on 10.0.0.3 can still access all resources in 192.168.0.x

Code:Status: active

To Action From
-- ------ ----
22/tcp LIMIT Anywhere
42069 LIMIT Anywhere
192.168.0.253 80 ALLOW 10.0.0.3
Anywhere DENY 10.0.0.3
22/tcp (v6) LIMIT Anywhere (v6)
42069 (v6) LIMIT Anywhere (v6)Any idea why this isn't working as expected?