Running a Dell PowerConnect N3048 that was on firmware 6.3.*.*.  Recently upgraded to 6.5.4.18 and it seems the access control list no longer applies correctly.  For example we have a DMZ VLan that we want to pull DHCP from a central server but nothing else.  So we have this setup:

ip access-list DMZDeny
1000 permit 67 192.168.40.0 0.0.0.255 192.168.30.50 0.0.0.0
1010 deny ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
1020 deny ip 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255
1030 permit every

Then on the VLan:

interface vlan 40
ip address 192.168.40.1 255.255.255.0
ip access-group DMZDeny in 1
exit

 

So if a computer is on 192.168.40.* it should be denied access to 192.168.20.* but it's not.  If I remove the last "permit every" then it can't even pull DHCP.  On the old firmware this worked as expected.

 

Did something change in the latest firmware to break this?  Or is there a better way of doing this?  It's like the rules are not applying in the correct order.