An example router includes a control unit configured to receive virtual private network (VPN) routing and forwarding table (VRF) configuration data defining a VRF for a VPN and VPN address space for the VPN, receive configuration data defining a measurement endpoint for measuring performance of a layer 3 (L3) service and associating the measurement endpoint with a remote measurement endpoint of a remote router. The control unit is configured to encapsulate, to generate a flow measurement packet, a layer 2 (L2) measurement packet in a layer 4 (L4) header and an L3 header, where the L3 header includes a source L3 address within the VPN address space and associated with the measurement endpoint, and where the L3 header includes a destination L3 address within the VPN address space and associated with the remote measurement endpoint. The control unit is configured to output the flow measurement packet to the remote router.