Mynull, is it the pre-natted or the natted?
correct me if I am wrong, the access-list is process before the NAT.
The subinterface is the outside (ip nat outside) and the direction of the access-list is 'in'. Meaning all traffic that is being block by the ACL is the traffic coming into the interface going to the router. Since the interface is the outside, before the packets goes out of the interface, the Source address (SA) is translated by the router, therefore the return packet should have the translated IP address as the destination address. If the traffic is initiated from the outside, the DA should the translated address and the access-list should take effect first to filter the translated IP address
let me know if i'm wrong, i'm curious mate
