Let me start by saying that I do not claim much expertise in packet tracer. But I believe that your question is really about functionality in access lists and not about packet tracer. I am much better able to address questions about access list functionality than I am about packet tracer.
Your description and your diagram do not make clear how the router is configured. Am I correct that the interface on what appears to be a 2911 identified as ford which connects to the switch is configured with subinterfaces for each of the vlans? And am I correct that each of the access lists that you describe will be applied on the appropriate subinterface as "in"? (it makes significant difference whether the access list will be applied "in" or applied "out")
At a high level your question is what to use in the second address of the access list. So let us first review some fundamentals of access lists. The first address refers to the source address of the packet while the second address refers to the destination address of the packet. So since the policy that you want to enforce will evaluate based on protocol (FTP or HTTP) and not on any particular destination address then the second address in your access list will be "any".
The other high level thing to remember that an access list used to filter data packets must include at least one permit. So in your access list after you deny the traffic that you do not want to go through you need to permit everything else.
So your access lists might look something like this
access-list 110 deny tcp 172.18.10.0 0.0.0.255 any eq 20-21
access-list 110 permit ip 172.18.10.0 0.0.0.255 any
!
access-list 120 deny tcp 172.18.20.0 0.0.0.255 any eq 80
access-list 120 permit ip 172.18.20.0 0.0.0.255 any
!
access-list 199 permit ip 172.18.99.0 0.0.0.255 any
HTH
Rick
HTH
Rick
