security {
    nat {        
        source {
            rule-set VENDOR_NAT {
                from zone VENDOR;
                to zone WAN;
                rule VENDOR_NO_NAT_DHCP {
                    match {
                        source-address 25.0.0.0/13;
                        destination-address [ 100.94.3.159/32 100.94.4.192/32 ];
                        destination-port {
                            67;
                        }
                    }
                    then {
                        source-nat {
                            off;
                        }
                    }
                }
            }
        }
    }
}