ACL outbound not allowed

Question

So the situation here is :
I have a layer 3 switch who is connected to a layer 2 ( d-link) switch via trunk line on the gi0/46 of the layer 3 switch.
I implement my ACL on this gi0/46 port inbound but I can't do this outbound on this port? it says "invalid input detected"
If I type: "ip access-group VTI ?" than it only show inbound as an option. How does this come ?
Another question I have is :
I have this access-list on the gi0/46 port inbound:
10 permit udp any any
20 permit ip any 10.1.40.192 0.0.0.63
30 permit ip any 10.1.40.0  0.0.0.127
40 deny ip any 10.1.0.0 0.0.255.255
50 permit ip any any
If I do this I can't access the layer 2 D-link anymore who has an ip address (10.1.40.145). 
I can access the D-link switch if i'm in the vlan 10 which is (10.1.40.0  0.0.0.127) that's because that one is allowed in my ACL above here.
But what must I do if i want that vlan 10 can access the D-link but the computers behind the D-link aren't allowed to access vlan 10 ?
Thanks
Jonas Vanraes

Answer 1

Hi !
Thank you for you very clear information on the PACL. The switch is an cisco 3560x switch
But for my second question forget what I said earlier.
The situation is like this: 
- They are 6 schools connected via VPN.
- In the image you can see the VLANs for one school
- Every school has his own system vlan which is always vlan 10 and always the first vlan in the subnet of the school
What do I want to succeed ?
- only vlan10 of every school must be able to access the switches who are in vlan999 , you can see that in the image
- my problem is if I implement the access-list I showed you above, only the vlan10 of the school where the switch(d-link) ispresent can access the switch but the other schools vlan 10 aren't able to access the switches. If I remove the ACL they can access the switch so the problem is definitely with the ACL
- So my question is if you still folow me: How can I allow the vlan10 of every school to access the switches but the computers behind the switches are not allowed the access the vlan 10 of every school except but their own vlan10 cause their Domain controller etc. is there.
Maybe this is more understandable
This are the vlan10 of every school
- 10.1.0.0 255.255.255.128 - school 1
- 10.1.8.0 255.255.255.128 - school 2
- 10.1.16.0 255.255.255.128 - school 3
- 10.1.24.0 255.255.255.128- school 4
- 10.1.32.0 255.255.255.128 - school 5
- 10.1.40.0 255.255.255.128 - school 6
If i do this : permit ip any 10.1.8.0 0.0.0.127 in my ACL on that gi0/46 port than the ip address range (10.1.8.0 ...) can access that d-link but the problem with this is that the computers behind the d-link also can access (10.1.8.0 ...)
If you don't understand I completely understand cause it's hard to explain
Jonas Vanraes