access-list cisco router 1721

Generally the rule of thumb is to deny what you want to deny first then place your permit statements afterward. I like named access-lists myself because if you want to make a change to it you don't have to remove the whole access-list to remove one line.

for example:

ip access-list extended "NAME" (you can make any name you want...without the quotation marks).

Say I want to deny a specific address to your WAN IP. The following statement would deny only 10.10.10.10 to 2.2.2.2.

deny ip 10.10.10.10 0.0.0.0 2.2.2.2 0.0.0.0

permit ip/tcp/udp (whatever protocol you specify, ip allows anything udp or tcp) source address or subnet destination address or subnet "eq port number" (eq specifies a port which is in the udp or tcp range)