这就是我想要做的

Deny the network that host 200.200.200.10 is on, telnet access to R3
Permit host 200.200.200.10 to telnet to R3
Deny host 200.200.200.10 all access to host 204.10 on distant network
Allow everything else

这就是我所拥有的

access-list 100 deny tcp 200.200.200.0 0.0.0.255 host 203.203.203.2 eq 23 
access-list 100 permit tcp 200.200.200.10 0.0.0.0 host 203.203.203.2 eq 23
access-list 100 deny ip 200.200.200.10 0.0.0.0 204.204.204.10 0.0.0.0
access-list 100 permit ip any any

    Current configuration : 896 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
!
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 200.200.200.1 255.255.255.0
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 201.201.201.1 255.255.255.0
 ip access-group 100 out
!
router rip
 version 2
 passive-interface FastEthernet0/0
 network 200.200.200.0
 network 201.201.201.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 100 deny tcp 200.200.200.0 0.0.0.255 host 203.203.203.2 eq telnet
access-list 100 permit tcp host 200.200.200.10 host 203.203.203.2 eq telnet
access-list 100 deny ip host 200.200.200.10 host 204.204.204.10
access-list 100 permit ip any any
!
no cdp run
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 password password
 login
!
!
!
end

我以为它会工作，但它没有？任何帮助，将不胜感激。