vyos@VyOS# set firewall name incoming_traffic_eth1.400 default-action accept
vyos@VyOS# set firewall name incoming_traffic_eth1.400 enable-default-log

vyos@VyOS# set firewall name incoming_traffic_eth1.400 rule 10 description block_192.168.4.0_to_192.168.2.0
vyos@VyOS# set firewall name incoming_traffic_eth1.400 rule 10 action drop
vyos@VyOS# set firewall name incoming_traffic_eth1.400 rule 10 source address 192.168.4.0/24
vyos@VyOS# set firewall name incoming_traffic_eth1.400 rule 10 destination address 192.168.2.0/24

vyos@VyOS# set interfaces ethernet eth1 vif 400 firewall in name incoming_traffic_eth1.400