R1(config)# ip access-list extended PAT
R1(config-ext-nacl)# permit ip 192.168.3.0 0.0.0.255 any
R1(config-ext-nacl)# deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
R1(config-ext-nacl)# permit ip 192.168.1.0 0.0.0.255 any
R1(config)# ip nat inside source list 10 interface gigabitEthernet 0/0 overload