>> адреса 1.1.1.1/32. Всё.

Коллега, вы указываете сферический в вакууме IP адрес и непонятно где он в вашей сети и в ней ли вообще.

Кроме того, фильтровать аксес-листами на IOS не модно уже сто лет как. Модно использовать стейтфул фаервол Zone-Based Firewall, до него раньше был ip inspect.

Вот для затравки рыба:

ip inspect log drop-pkt
zone security LAN
zone security INET
object-group service IPSEC 
 esp
 ahp
 udp eq isakmp
 udp eq non500-isakmp
 gre
object-group service good_ICMP
 icmp echo
 icmp echo-reply
 icmp parameter-problem
 icmp unreachable
 icmp source-quench
 icmp traceroute
 icmp time-exceeded
ip access-list extended zbfc_ICMP
 permit object-group good_ICMP any any
class-map type inspect match-any zbfc_ICMP
 match access-group name zbfc_ICMP
ip access-list extended zbfc_IPSEC
 permit object-group IPSEC any any

class-map type inspect match-any zbfc_IPSEC
 match access-group name zbfc_IPSEC
class-map type inspect match-any zbfc_INET_IN_SELF
 match protocol ssh
 match protocol ntp
policy-map type inspect zbfp_INET2LAN
 class class-default
  drop
policy-map type inspect zbfp_INET2SELF
 class zbfc_INET_IN_SELF
  pass
 class zbfc_IPSEC
  pass
 class zbfc_ICMP
  pass
class-map type inspect match-any zbfc_DROP_OUT
 match protocol bittorrent
 match protocol pptp
 match protocol l2tp
!
class-map type inspect match-any zbfc_INSPECT_OUT
 match protocol ftp
 match protocol tcp
 match protocol udp
 match protocol icmp
policy-map type inspect zbfp_LAN2INET
 class zbfc_DROP_OUT
  drop log
 class zbfc_INSPECT_OUT
  inspect
 class class-default
  pass
zone-pair security zp_INET2LAN source INET destination LAN
 service-policy type inspect zbfp_INET2LAN
zone-pair security zp_INET2SELF source INET destination self
 service-policy type inspect zbfp_INET2SELF
zone-pair security zp_LAN2INET source LAN destination INET
 service-policy type inspect zbfp_LAN2INET
! interface Vlan1
!  zone-member security LAN
! interface TunXX
!  zone-member security LAN
! interface Dial1
!  zone-member security INET