How to create ACL to block traffic from one network to another

[abbas64]

I am trying to create an ACL to deny traffic from one network to anther network, but my lab assistant told me it is wrong. I am not sure what I am doing wrong.

I have a router with a computer connected to g0/0 interface with network ID 192.168.1.0/24. I need to block traffic from this network reaching 172.16.1.2/24 host. This is what I have done:

ip access-list extended Block_traffic

deny tcp 192.168.1.0 0.0.0.255 host 172.16.1.2

permit tcp any any

Can anyone please tell me what I am doing wrong?

[Jon Marshall · Accepted solution]

Firstly that acl only blocks TCP to that specific host. If  you want to block ICMP and UDP as well change "tcp" to "ip".

Secondly the acl should be applied to the gi0/0 interface in an inbound direction.

Jon