set security nat source rule-set VENDOR_NAT from zone VENDOR
set security nat source rule-set VENDOR_NAT to zone WAN
set security nat source rule-set VENDOR_NAT rule VENDOR_NO_NAT_DHCP match source-address 25.0.0.0/13
set security nat source rule-set VENDOR_NAT rule VENDOR_NO_NAT_DHCP match destination-address 100.94.3.159/32
set security nat source rule-set VENDOR_NAT rule VENDOR_NO_NAT_DHCP match destination-address 100.94.4.192/32
set security nat source rule-set VENDOR_NAT rule VENDOR_NO_NAT_DHCP match destination-port 67
set security nat source rule-set VENDOR_NAT rule VENDOR_NO_NAT_DHCP then source-nat off