communication between VLANs

[Dopamine]

Hello, I have a question! 

I have one switch 2960 and one router. 

in switch, I have 3 VLANs. VLAN 2, 3, and 4.

I want VLAN 2 to connect to VLAN 3 and  VLAN 4, but VLAN 3 and 4 can not connect to VLAN 2. 

Do I have to use the Access List? How do I write that Access List? 

Thanks.

[paul driver · Accepted solution]

Hello
You don’t say what type of traffic you would like vlan 2 to be allowed to access vlan 3-4, however based on tcp sessions this can be accomplished by routed acls so any tcp traffic initiated from vlan2 towards either vlan 3-4 , then the related return traffic will be allowed.
However, if any traffic was initiated from either vlan 3-4 twoards vlan 2 it will be denied, Lastly traffic between vlan 3-4 will be allowed.

switch or rtr
ip access-list exteneded Vl2to3-4
permit tcp 192.168.3.0 0.0.0.255 any established
deny tcp 192.168.3.0 0.0.0.255 any
permit tcp 192.168.4.0 0.0.0.255 any established
deny tcp 192.168.4.0 0.0.0.255 any
permit ip any any

switch
int vlan 2
ip access-group Vl2to3-4 out

or

RTR (if rtr is perfroming inter-vlan routing and NOT switch)
int x/x.2
encapuslation dot1q 2
description vlan2
ip access-group Vl2to3-4 out

[Dopamine]

thank you so much for helping me.