That literally means “allow packets from 192.168.98.0/24, 192.168.99.0/24, and 192.168.100.0/24 to pass out the ‘hol’ interface, and drop every other packet”. What about return traffic, from the Internet back to you? You can now try to establish a connection to a server, but the server can’t respond. After all traffic from the server to the LAN client doesn’t come from any of those three networks, and doesn’t go out the ‘hol’ interface. Return traffic only matches the drop rule.
The easiest solution is to be stateful, and allow all packets that are parts of established connections, and to then only allow trusted hosts to establish connections. You can also simplify things by using an address list to enumerate trusted hosts and networks. The shortest way to write your firewall rule set would be: