I have created an access-list on my router. I denied one network, then permitted any. Denied network cannot ping my network. It is OK. But I also cannot ping that network. Why? Who can explain me? There is no access-list on that network.
That is because ping is bi-directional, and hosts on the network cannot reply.
Instead of a standard access list (outbound from the router to your network), if you use an extended access list, you can deny only an ICMP Echo Request request (inbound to the router from the network you want to restrict). That should allow an ICMP Echo Reply back to your network.
access-list 101 permit icmp any <your network address> <your network mask> echo-reply access-list 101 deny icmp any <your network address> <your network mask> echo access-list 101 permit ip any any interface g0/1 !*** the interface for the restricted network *** ip access-group 101 in