Whitelisting works for subnets for outgoing and incoming connections, unless the node has been added using addnode, in which case the permissions are always "N/A" in the GUI and the node is disconnected as if there is no whitelisting (e.g. when historical block download is reached, or a mempool request comes in, etc).