conf t
access-list 10 deny 192.168.50.0 0.0.0.255
access-list 10 permit any
end

# VLAN 1 DEFAULT NATIVE
conf t
vlan 1
interface vlan 1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip access-group 10 out
end

# VLAN 20
conf t
vlan 20
name Dev
interface vlan 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip access-group 10 out
end

$ ping 192.168.0.200
PING 192.168.0.200 (192.168.0.200) 56(84) bytes of data.
From 192.168.50.1 icmp_seq=1 Packet filtered
From 192.168.50.1 icmp_seq=2 Packet filtered
From 192.168.50.1 icmp_seq=3 Packet filtered

$ ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=255 time=17.9 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=255 time=30.4 ms

$ ping 192.168.20.1
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data.
64 bytes from 192.168.20.1: icmp_seq=1 ttl=255 time=2.73 ms
64 bytes from 192.168.20.1: icmp_seq=2 ttl=255 time=23.7 ms

vlan internal allocation policy ascending
!
!
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0/0
 description WAN
 ip address x.x.x.x 255.255.255.252
 ip nat outside
 negotiation auto
!
interface GigabitEthernet0/0/1
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/1/0
 switchport mode trunk
 switchport nonegotiate
!
interface GigabitEthernet0/1/1
 shutdown
!
interface GigabitEthernet0/1/2
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/1/3
 switchport access vlan 20
 switchport mode access
!
interface GigabitEthernet0/1/4
 shutdown
!
interface GigabitEthernet0/1/5
 shutdown
!
interface GigabitEthernet0/1/6
 switchport mode access
!
interface GigabitEthernet0/1/7
 switchport mode access
!
interface Vlan1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip access-group 10 in
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip access-group 10 out
!
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
 ip access-group 10 out
!
interface Vlan50
 ip address 192.168.50.1 255.255.255.0
 ip nat inside
!
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
no ip http server
ip http secure-server
ip dns server
ip route 0.0.0.0 0.0.0.0 x.x.x.x
!
!
ip access-list standard NAT
 permit 192.168.10.0 0.0.0.255
 permit 192.168.0.0 0.0.0.255
 permit 192.168.20.0 0.0.0.255
 permit 192.168.50.0 0.0.0.255
!
access-list 10 deny   192.168.50.0 0.0.0.255
access-list 10 permit any
!
!
!
!
control-plane
!
!
line con 0
 transport input none
 stopbits 1
line vty 0 4
 login local
 transport input ssh
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end

access-list 10 deny 192.168.50.0 0.0.0.255
access-list 10 permit any

access-list 20 deny 192.168.0.0 0.0.0.255
access-list 20 deny 192.168.10.0 0.0.0.255
access-list 20 deny 192.168.20.0 0.0.0.255
access-list 20 permit any

interface Vlan1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan50
 ip address 192.168.50.1 255.255.255.0
 ip nat inside
 ip access-group 20 out

conf t
ip access-list extended GUESTSACL
deny ip 192.168.50.0 0.0.0.255 192.168.0.0 0.0.0.255
deny ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
deny ip 192.168.50.0 0.0.0.255 192.168.20.0 0.0.0.255
permit ip any any
end
conf t
int vlan 50
ip access-group GUESTSACL in
end

conf t
interface vlan 50
no ip unreachables
end