case:
voip and mail server behind vyos
log parser on both servers create black list on shared resouce
vyos (in all branches of company) have firewall rule with this black list
profit

Firewall groups used ipset, it would be cool to use these groups in the nat rules too and soone (wlb test rules target address etc).
It is necessary to make global address groups based on ipset.

Just install package 'libpam-systemd' to resolve this

Ponder isn`t suitable for discussion... May be we can try 'Conpherence' app for this?

Константин, тоже страдаю от этого, я поправлю эту проблему и поделюсь решением с сообществом.
Попробуй следующее:

sudo su
ip rule add from "wan1 ip" table 1
ip rule add from "wan2 ip" table 2

No, after 1.0.5 it doesnt work. DNAT on second wan works, but incoming local traffic doesnt (ping etc) - vyos reply from first wan with SNAT (overrides source ip to wan2 ip).