With the code below, it allows a device to send a broadcast for a DHCP address. Once it gets a 192.168.81.x IP it should be able to communicate over the network. My question is, doesn't the deny statements get hit first and 'match' the 192.168.81.x address before it hits the permit statement for that network?
ip access-list extended guest-wifi
permit udp any any eq bootps
permit udp any any eq bootpc
deny ip any 192.168.0.0 0.0.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 10.0.0.0 0.255.255.255
permit ip 192.168.81.0 0.0.0.255 any