Firewalld: How to whitelist just two IP-addresses, not on the same subnet

There is good answer on another site.

So I tried to do this on test VM with such commands:

firewall-cmd --zone=public --change-interface=eth0 --permanent
firewall-cmd --zone=public --add-source=192.168.1.2/32 --permanent
firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.2/32" invert="True" drop' --permanent

And this work, test VM doesn't reacheble from any IP except only one.

Output for firewall-cmd --zone=public --list-all is:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 192.168.1.2/32
  services: ssh dhcpv6-client
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source NOT address="192.168.1.2/32" drop