R1(config)# ip access-list extended outgoing_traffic_tun0
R1(config-ext-nacl)# 10 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 log
R1(config-ext-nacl)# 1000 deny ip any any log