access list on a vlan interface wont work!

[dmsman]

I have a core switch "HP 8206" connected through vlan 2 to an isp router which in turn connects me to my branch on subnet 192.168.2.1/24 through an isp router, im trying to control my vlan 1 traffic 192.168.1.1/24 to vlan 2 through an access list on the vlan 1 interface but it simply isn't working even after trying ip access-group acl in,out,vlan please help

ip access-group extended test
Deny ip 192.168.1.25 255.255.255.255 192.168.2.7 255.255.255.255
Permit ip any any

vlan 1
name "Server-VLAN"
untagged Trk45
ip address 192.168.1.1 255.255.255.0

ip access-group test in

vrrp vrid 1
virtual-ip-address 192.168.1.1
priority 255
enable
exit

[Ivan_B]

Hi @dmsman !

This ACL should deny traffic sourced from single IP 192.168.1.25 to single IP 192.168.2.7, the rest is allowed. Is it really what you need to achieve? Just block IP traffic between those two single IP addresses?

[dmsman]

no this isn't the full acl this is just an example , the thing is the traffic is stil going as the acl isnt there

[Ivan_B]

You need to be sure your hosts in Vlan 1 are using 192.168.1.1 as default gateway.

Another issue, sorry, I've overlooked it - you are using subnet masks in the ACL while you must use wildcard masks instead:

ip access-group extended test
Deny ip 192.168.1.25 0.0.0.0 192.168.2.7 0.0.0.0
Permit ip any any

Thus, if you want to block the whole subnet and the subnet has /24 mask (255.255.255.0), then the correct wildcard mask will be 0.0.0.255

[dmsman]

-please is there a way to find hits on the access list on the vlan when i use access-group in or out? i could only find hits using show statistics aclv4 vlan x vlan

-what is the difference between access-group in/out/vlan?