Although I think this is an easy question, I am quite rusty when it comes to IOS.  In an effort to save money my Temple is not upgrading our still working Cisco 831.  We are running a primary network - the "office network" 10.100.10.0, and a new "Guest network" 10.10.10.0, which is configured as the secondary network on the one Ethernet port.  Both networks are working fine and can access the Internet connection we have.

We want to prevent the guest network from being able to access the office network, yet still allow both to access the internet.  I have tried various combinations of ACL's - such as denying IP between 10.100.10.0 and 10.10.10.0 and vice versa, but to no avail.  I can still ping devices on one network from the other.

I originally was hoping to wire the guest network to one of the ethernet ports, and the office network to another; but on this router, I cannot address the 4 ethernet ports seperatly, so I am stuck putting both networks on the same wire.

Is this even possible to prevent the networks from seeing each other while still maintaining their internet connectivity?

Thanks in advance.