There is a missing dependency from nat, nat66 and firewall for the VRF environment.

VRF probes during setup if NAT, NAT66 or a statefull firewall is configured and if so, it will install the nftables conntrack helper.

If the firewall is added later, the VRF code portion is not re-called and thus the nftables rule is not setup.

The reason is because of https://github.com/vyos/vyos-1x/blob/42a3be5b079f005115ce107935929ebb4a7139e0/src/conf_mode/vrf.py#L123-L124 beeing called only from the VRF script.

NOTE

This task is invalid, as nat.py calls system_conntrack.py which has a back dependency on vry.py. So the dependency graph is fully operational