For users running an ISP, enabling the firewall to secure just VyOS on the input/output chains can impact the overall performance of forwarding, since conntrack will be enabled for all traffic. It could be useful to disable conntrack per chain for these users.

This can be accomplished by adding these lines to the top of the appropriate chains (IPv4 Example):

Input:
ip vyos_filter VYOS_PREROUTING_raw fib daddr . iif type local notrack counter

Output:
ip vyos_filter VYOS_OUTPUT_raw notrack counter

Forward:
ip vyos_filter VYOS_PREROUTING_raw fib daddr . iif type unicast notrack counter