What's the procedure to limit a subnet on a Cisco router from seeing another subnet when both are using NAT?

Question

I have a Cisco 891F router. The internet is hooked up to G8. The student network is Vlan 200, and the Office is Vlan 100.

(I know the internet has an internal subnet (192.168.1.5), but that's because I'm testing in the lab.)

So the situation is that I have the internet on G8, and a classroom on vlan 200, with the office staff on vlan 100. I'm using NAT, actually, PAT, for each internal network and all is working well for internet access from both internal networks.

However, I need to add an ACL so that the 192.168.200.0/24 student network (vlan 200) can not see anything in the 192.168.151.0/24 office network (vlan 100).

I have not been able to find or work through anything with the "deny" along with the NAT that has the limited access described above.

Here is the interface and acl config: (any help is appreciated) -T

interface GigabitEthernet0
 switchport access vlan 100
 no ip address
!
interface GigabitEthernet1
 switchport access vlan 200
 no ip address
!
interface GigabitEthernet2
 no ip address
!
interface GigabitEthernet3
 no ip address
!
interface GigabitEthernet4
 no ip address
!
interface GigabitEthernet5
 no ip address
!
interface GigabitEthernet6
 no ip address
!
interface GigabitEthernet7
 no ip address
!
interface GigabitEthernet8
 description To Internet
 ip address 192.168.1.5 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
!
interface Vlan100
 description Office Network
 ip address 192.168.151.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan200
 description Student Network
 ip address 192.168.200.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Async3
 no ip address
 encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 10 interface GigabitEthernet8 overload
ip nat inside source list 20 interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
access-list 10 permit 192.168.151.0 0.0.0.255
access-list 20 permit 192.168.200.0 0.0.0.255
!

Answer 1

First of all, you don't use NAT between private subnets. You only use NAT when it is required, most prominently between private and public subnets.

If you do use (source) NAT, you can't filter in the destination subnet because all you see is the NATed router's IP address.

The syntax for basic ACLs is

permit|deny <sourcesubnet> <sourcewildcard> <destinationsubnet> <destinationwildcard>

Remember that there's always an implied deny any any at each ACL's end. If you don't want that to catch everything that you haven't explicitly defined, use a permit any any at the end.

I need to add an ACL so that the 192.168.200.0/24 network (vlan 200) can not see anything in 192.168.151.0/24 (vlan 100).

With permitting everything else, that'd be

1000 deny 192.168.200.0 0.0.0.255 192.168.151.0 0.0.0.255
9999 permit any any

Put that as in rule on the ingress port(s) for VLAN 200 or on VLAN 200 itself, depending on the router's capabilities.

Currently,

access-list 10 permit 192.168.151.0 0.0.0.255
access-list 20 permit 192.168.200.0 0.0.0.255

you're permitting those two subnets access to everywhere (that's what my less specific permit any any does, but for any source subnet). That's absolutely fine, but for the desired filtering to take place, you need to deny subnet 192.168.200.0/24 access to 192.168.151.0/24 before (ie. with maximum line number 19) permitting everything - remember that ACL rules are applied on a first-hit base, top to bottom.