set interfaces openvpn vtun20 encryption ncp-ciphers 'aes256'
set interfaces openvpn vtun20 hash 'sha512'
set interfaces openvpn vtun20 mode 'server'
set interfaces openvpn vtun20 openvpn-option 'push keepalive 1 10'
set interfaces openvpn vtun20 server subnet '10.10.2.0/24'
set interfaces openvpn vtun20 server topology 'subnet'
set interfaces openvpn vtun20 tls ca-certificate 'ca'
set interfaces openvpn vtun20 tls certificate 'cert'
set interfaces openvpn vtun20 tls dh-params 'dh'

set system conntrack ignore ipv4 rule 10 destination address '100.64.0.0/28'

vyos@r4# run show conf com | match "nat "
set nat source rule 100 destination port '5000-8000'
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 protocol 'tcp'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'
[edit]
vyos@r4# 
[edit]
vyos@r4# run show nat source rules 
Rule    Source       Destination                    Proto    Out-Int    Translation
------  -----------  -----------------------------  -------  ---------  -------------
100     10.0.0.0/24  0.0.0.0/0                      IP       eth0       masquerade
        sport any    dport {'range': [5000, 8000]}
[edit]
vyos@r4# 
[edit]
vyos@r4# 
[edit]
vyos@r4# run show ver
Version:          VyOS 1.5-rolling-202406260020
Release train:    current
Release flavor:   generic

vyos@r4:~$ show version all | match conntrack
ii  conntrack                            1:1.4.7-1+b2                     amd64        Program to modify the conntrack tables
ii  conntrackd                           1:1.4.7-1+b2                     amd64        Connection tracking daemon
ii  libnetfilter-conntrack3:amd64        1.0.9-1                          amd64        Netfilter netlink-conntrack library
vyos@r4:~$ 
vyos@r4:~$ show version 
Version:          VyOS 1.5-rolling-202406260020
Release train:    current
Release flavor:   generic

# cat /tmp/offload.nft