目的是禁止2网段的主机访问1网段，3网段不用限制，
access-list 1 deny 192.168.2.0 0.0.0.255
access-list 1 permit any
int f0/1
ip access-group 1 out