vyos@vyos:~\$ show configuration
firewall {
    all-ping enable
    broadcast-ping disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    log-martians enable
    name private-local {
        rule 10 {
            action accept
            icmp {
                type-name echo-request
            }
            protocol icmp
        }
    }
    name private-public {
        default-action accept
    }
    name public-local {
        default-action drop
    }
    name public-private {
        default-action drop
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    state-policy {
        established {
            action accept
        }
        invalid {
            action drop
        }
        related {
            action accept
        }
    }
    syn-cookies enable
}
interfaces \{
    ethernet eth0 {
        address 10.10.10.5/24
        hw-id 0c:c1:7b:8b:98:00
    }
    ethernet eth1 {
        address dhcp
        hw-id 0c:c1:7b:8b:98:01
    }
    ethernet eth2 {
        address 10.10.10.6/24
        hw-id 0c:c1:7b:8b:98:02
    }
    loopback lo {
    }
\}
nat {
    source {
        rule 10 {
            outbound-interface eth1
            source {
                address 10.10.10.0/24
            }
            translation {
                address masquerade
            }
        }
    }
}
protocols {
    static {
    }
}
service {
    dhcp-relay {
        interface eth2
        interface eth1
        interface eth0
        relay-options {
            relay-agents-packets append
        }
        server 10.10.10.1
    }
}
system \{
    config-management {
        commit-revisions 100
    }
    console {
        device ttyS0 {
            speed 115200
        }
    }
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
        }
    }
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
        server 2.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level info
            }
            facility protocols {
                level debug
            }
        }
    }
\}
zone-policy {
    zone local {
        from private {
            firewall {
                name private-local
            }
        }
        from public {
            firewall {
                name public-local
            }
        }
        local-zone
    }
    zone private {
        default-action drop
        from local {
            firewall {
            }
        }
        from public {
            firewall {
                name public-private
            }
        }
        interface eth0
        interface eth2
    }
    zone public {
        default-action drop
        from local {
            firewall {
            }
        }
        from private {
            firewall {
                name private-public
            }
        }
        interface eth1
    }
}