Create a access list in "router-on-a-stick"

Question

I am trying to create a access in a "router-on-a-stick" which only allow VLAN 62 to communicate with a server on another VLAN and no other hosts in the other VLANs can get to VLAN 62.To be clear, my VLAN 62 is a VLAN for webcams and my server is the registration server. I have try doing standard and extended acl but it just wouldn't work. Can anyone help me out ?
P.s: I have one question, too. In standard acl, is it true that the "deny part" have to be on top of the "permit part". Sorry for my bad English.

version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
ip dhcp pool 61
 network 192.168.6.64 255.255.255.192
 default-router 192.168.6.65
ip dhcp pool 62
 network 192.168.6.128 255.255.255.192
 default-router 192.168.6.129
ip dhcp pool 2
 network 192.168.6.0 255.255.255.192
 default-router 192.168.6.1
!
!
!
ip cef
no ipv6 cef
!
!
!
!
license udi pid CISCO1941/K9 sn FTX1524S9UZ
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.2
 encapsulation dot1Q 2
 ip address 192.168.6.1 255.255.255.192
!
interface GigabitEthernet0/0.61
 encapsulation dot1Q 61
 ip address 192.168.6.65 255.255.255.192
!
interface GigabitEthernet0/0.62  ! *** I want this VLAN to be completely separate from others except for VLAN 2 ***
 encapsulation dot1Q 62
 ip address 192.168.6.129 255.255.255.192
 ip access-group 162 in
 ip access-group 162 out
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/1/0
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial0/1/1
 ip address 192.168.67.3 255.255.255.0
!
interface Vlan1
 no ip address
 shutdown
!
router rip
 network 192.168.6.0
 network 192.168.67.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 162 permit ip 192.168.6.128 0.0.0.64 192.168.6.0 0.0.0.64
access-list 162 deny ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Answer 1

Edited:

To allow devices on VLAN 62 to talk to VLAN2, and nothing else.

access-list 162 permit ip 192.168.6.128 0.0.0.63 192.168.6.0 0.0.0.63
access-list 162 permit udp any any eq bootps
access-list 163 permit ip 192.168.6.0 0.0.0.63 192.168.6.128 0.0.0.63
access-list 163 permit udp any any eq bootpc
interface GigabitEthernet0/0.62
ip access-group 162 in
ip access-group 163 out

Note the wildcard mask 0.0.0.63 in the ACLs. Also, "deny any any" is implicit at the end of every ACL. If you explicitly state it, it goes at the end.

Answer 2

I would assume that you want hosts in VLAN 62 to reach hosts in VLAN 2 (and vice versa) only, and nothing else (no Internet...):

access-list 162 permit ip 192.168.6.128 0.0.0.63 192.168.6.0 0.0.0.63
access-list 162 permit udp any any eq bootps
access-list 162 deny   ip any any log

access-list 163 permit ip 192.168.6.0 0.0.0.63 192.168.6.128 0.0.0.63
access-list 163 deny   ip any any log

interface FastEthernet0/0.62
 encapsulation dot1Q 62
 ip address 192.168.6.129 255.255.255.192
 ip access-group 162 in
 ip access-group 163 out

Notice that the rule access-list 162 permit udp any any eq bootps is for hosts in VLAN 62 to reach this Router (as DHCP server) to get DHCP IP addresses. In this setup, we do not need to mirror this rule in access-list 163.

Last but not least, the best practice is: always put an explicit deny ip any any rule with log option at the end of your ACL to verify what is blocked/denied. You then can modify the ACL accordingly.

I hope it is helpful and you can solve this problem.