>>можно так
>>access-l 100 den ip 192.168.129.0 0.0.0.255 192.168.10.0 0.0.0.255
>>access-l 100 perm ip an an
>>int vl 2
>>ip access-g 100 in
>
>не помогает.
>может конечно что-то не так делаю (((
>
>interface FastEthernet0/0
> ip address 192.168.122.2 255.255.255.0
> ip nat outside
> duplex full
> speed auto
> no mop enabled
>!
>interface FastEthernet0/3/0
> switchport access vlan 2
> no mop enabled
>!
>interface FastEthernet0/3/1
> switchport access vlan 3
> no mop enabled
>
>!
>interface Vlan1
> no ip address
> shutdown
>!
>interface Vlan2
> ip address 192.168.129.1 255.255.255.0
> ip access-group 100 in
> ip nat inside
>!
>interface Vlan3
> ip address 192.168.10.1 255.255.255.0
> ip nat inside
>!
>ip classless
>ip route 0.0.0.0 0.0.0.0 192.168.122.1
>!
>ip http server
>ip nat inside source list 1 interface FastEthernet0/0 overload
>ip nat inside source list 2 interface FastEthernet0/0 overload
>!
>access-list 1 permit 192.168.129.0 0.0.0.255
>access-list 2 permit 192.168.10.0 0.0.0.255
>access-list 100 deny   ip 192.168.129.0 0.0.0.255 192.168.10.0 0.0.0.255
>access-list 100 permit ip any any
>dialer-list 1 protocol ip permit

А если так?
!
ip nat inside source list preved interface FastEthernet0/0 overload
!
ip access-list extended preved
deny ip 192.168.129.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.129.0 0.0.0.255 any
!
access-list 100 deny   ip 192.168.129.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip any any

ну и NAT на вторую сетку так же...