How can i i allow VLAN 10 to communicate with server but not VLAN 20

[darrenfoo891]

Spoiler

I'm trying to allow VLAN 10 which includes pcs',  EMP 1 AND EMP 2 to pass through the router to the EMP server.

I also want to restrict traffic from VLAN 20, which includes PAT 1 and PAT 2 from accessing the server.

I created VLAN 10 & 20 to segment the network. I also created sub-interfaces in router 3 to allow different VLANs to communicate with each other.

This is for my assignment. Thanks for the help 

[paul driver]

Hello
Can you elaborate on your design please-  you show two rtrs(one of which you say is performing the routing) so whats the other rtr doing?

Maybe share your PT file?

[darrenfoo891]

HI Paul, yes router 3 performing the routing that would allow different vlans to communicate. Router 4 is where ACL is applied to control traffic from the vlans  accessing the server

This little design is to see how Employees and Patients of a clinic can communicate and how employees (vlan 10) only should be able to communicate with the server. However, this is not the complete design. I just wanted to test something out. 

your help is greatly appreciated