set nat66 destination rule 100 destination address '2001:1111:1111:1111::10'
set nat66 destination rule 100 inbound-interface 'eth0'
set nat66 destination rule 100 translation address 'fd00:1111:1111:1111::10'
set nat66 source rule 100 destination prefix '!fd00:2222:2222:2222::/64'
set nat66 source rule 100 outbound-interface 'eth0'
set nat66 source rule 100 source prefix 'fd00:1111:1111:1111::/64'
set nat66 source rule 100 translation address '2001:1111:1111:1111::10'
set nat66 source rule 120 destination prefix '2001:db8:2222::/64'
set nat66 source rule 120 outbound-interface 'eth0'
set nat66 source rule 120 source prefix '2001:db8:1111::/64'
set nat66 source rule 120 translation address 'masquerade'
set nat66 source rule 130 destination prefix '2001:db8:2222::/64'
set nat66 source rule 130 outbound-interface 'eth0'
set nat66 source rule 130 source prefix '2001:db8:2244::/64'
set nat66 source rule 130 translation address 'masquerade'

vyos@r14:~$ show nat66 source rules 
Rule    Source                    Destination                Proto    Out-Int    Translation
------  ------------------------  -------------------------  -------  ---------  -----------------------
100     fd00:1111:1111:1111::/64  !fd00:2222:2222:2222::/64  IP6      eth0       2001:1111:1111:1111::10
        sport any                 dport any
120     2001:db8:1111::/64        2001:db8:2222::/64         IP6      eth0       masquerade
        sport any                 dport any
130     2001:db8:2244::/64        2001:db8:2222::/64         IP6      eth0       masquerade
        sport any                 dport any
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ show nat66 destination  rules 
Rule    Source     Destination              Proto    In-Int    Translation
------  ---------  -----------------------  -------  --------  -----------------------
100     ::/0       2001:1111:1111:1111::10  any      eth0      fd00:1111:1111:1111::10
        sport any  dport any
vyos@r14:~$

vyos@r14:~$ show conntrack statistics 
CPU    Found    Invalid    Insert    Insert fail      Drop    Early drop    Errors    Search restart
-----  -------  ---------  --------  ---------------  ------  ------------  --------  -----------------
cpu=0  found=0  invalid=0  insert=0  insert_failed=0  drop=0  early_drop=0  error=0   search_restart=0
cpu=1  found=0  invalid=0  insert=0  insert_failed=0  drop=0  early_drop=0  error=0   search_restart=0
cpu=2  found=0  invalid=0  insert=0  insert_failed=0  drop=0  early_drop=0  error=0   search_restart=0
cpu=3  found=0  invalid=0  insert=0  insert_failed=0  drop=0  early_drop=0  error=0   search_restart=48
vyos@r14:~$

set nat66 destination rule 120 description 'foo'
set nat66 destination rule 120 destination port '4545'
set nat66 destination rule 120 inbound-interface 'eth0'
set nat66 destination rule 120 protocol 'tcp'
set nat66 destination rule 120 source address '2001:db8:2222::/64'
set nat66 destination rule 120 source port '8080'
set nat66 destination rule 120 translation address '2001:db8:1111::1'
set nat66 destination rule 120 translation port '5555'

vyos@r14# run show conf com | match vpn
set vpn openconnect authentication local-users username foo password 'bar'
set vpn openconnect authentication mode local 'password'
set vpn openconnect listen-ports tcp '8443'
set vpn openconnect listen-ports udp '8443'
set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
set vpn openconnect network-settings name-server '100.64.0.1'
set vpn openconnect ssl ca-certificate 'ca-ocserv'
set vpn openconnect ssl certificate 'srv-ocserv'
[edit]
vyos@r14# commit
No configuration changes to commit
[edit]
vyos@r14# sudo netstat -tulpn | grep 8443
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      23880/ocserv-main   
tcp6       0      0 :::8443                 :::*                    LISTEN      23880/ocserv-main   
udp        0      0 0.0.0.0:8443            0.0.0.0:*                           23880/ocserv-main   
udp6       0      0 :::8443                 :::*                                23880/ocserv-main   
[edit]
vyos@r14# set vpn openconnect authentication local-users username foo2 password 'bar2'
[edit]
vyos@r14# commit
[ vpn openconnect ]
"tcp" port "8443" is used by another service

sudo nano /etc/systemd/system/vyos-telegraf.service.d/10-override.conf

set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 protocol 'tcp'
set firewall name FOO rule 10 tcp flags syn
set firewall name FOO rule 10 tcp mss '1-500'

root@r14:/home/vyos# cat tmp.nft | wc -l
20029
root@r14:/home/vyos# 
root@r14:/home/vyos# sudo time nft -f tmp.nft
real	0m 0.20s
user	0m 0.13s
sys	0m 0.06s
root@r14:/home/vyos#

root@r14:/home/vyos# cat tmp.nft | wc -l
200029
root@r14:/home/vyos# 
root@r14:/home/vyos# sudo nft flush ruleset
root@r14:/home/vyos# 
root@r14:/home/vyos# sudo time nft -f tmp.nft
real	0m 1.91s
user	0m 1.20s
sys	0m 0.70s
root@r14:/home/vyos#

diff --git a/data/templates/monitoring/override.conf.j2 b/data/templates/monitoring/override.conf.j2
index 9f1b4ebe..63e479af 100644
--- a/data/templates/monitoring/override.conf.j2
+++ b/data/templates/monitoring/override.conf.j2
@@ -1,7 +1,10 @@
+{% set vrf_command = 'ip vrf exec ' ~ vrf ~ ' ' if vrf is vyos_defined else '' %}
 [Unit]
 After=vyos-router.service
 ConditionPathExists=/run/telegraf/vyos-telegraf.conf
 [Service]
+ExecStart=
+ExecStart={{ vrf_command }}/usr/bin/telegraf -config /run/telegraf/vyos-telegraf.conf -config-directory /etc/telegraf/telegraf.d $TELEGRAF_OPTS
 Environment=INFLUX_TOKEN={{ influxdb.authentication.token }}
 CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_ADMIN
 AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
diff --git a/interface-definitions/service-monitoring-telegraf.xml.in b/interface-definitions/service-monitoring-telegraf.xml.in
index 36f40a53..dc014ee1 100644
--- a/interface-definitions/service-monitoring-telegraf.xml.in
+++ b/interface-definitions/service-monitoring-telegraf.xml.in
@@ -306,6 +306,7 @@
                   </leafNode>
                 </children>
               </node>
+              #include <include/interface/vrf.xml.i>
             </children>
           </node>
         </children>

nft insert rule ip filter VYOS_FW_FORWARD ip 'saddr & 0.255.0.255 != 0.11.0.13' counter

root@r1:/home/vyos# nft insert rule ip6 filter INPUT ip6 saddr ::dead:beef/::ffff:ffff counter
Error: syntax error, unexpected string, expecting number
insert rule ip6 filter INPUT ip6 saddr ::dead:beef/::ffff:ffff counter
                                                   ^^^^^^^^^^^
root@r1:/home/vyos#

set nat static rule 10 destination address '10.0.1.1'
set nat static rule 10 inbound-interface 'eth0'
set nat static rule 10 translation address '192.168.1.1'