Allow access to VPN (PPTP) only from specific public IPs and general security questions

I have a basic knowledge of iptables and practically no idea how asuswrt hadles the routing / firewalling / security.

1. I installed asuswrt-merlin (380.57) on RT-AC87U and would like to setup a VPN (PPTP) server to only allow incoming connections from a specific ip/ip ranges and drop all others. A sample firewall-start script would be greatly appreciated.

2. default iptables rules seems to be a bit of a mess (default settings, VPN enabled):

Allow access to VPN (PPTP) only from specific public IPs and general security questions