Need help with iRULE

Please try this:

when CLIENT_ACCEPTED {
    if { [IP::addr [IP::client_addr] equals x.x.x.x/23] } {
        reject
    } 
}

I'm not sure what your intention is with IP::local_addr, but in the client side context that will give you the IP of the virtual server, or in an IP forwarding VIP, the IP of the server the client is ultimately connecting to. If you want the client's IP address, use the IP::client_addr command. You also shouldn't need the forward command. I don't think it hurts anything though. Last, the snat none command is in the root of the CLIENT_ACCEPTED event, so it applies to everything. If you don't need SNAT, then don't apply it to the VIP.