Read your network. Then run it.

flowruby 1.1

# Check rules in order; stop at the first match.
policy_chain "main" do
  position 10
  mode :first_match
end

# Block a named app, rather than every connection.
policy "block-youtube" do
  chain :main, position: 10
  where { app == "YouTube" }
  action :drop
end

flowruby 1.1

policy_chain "monitoring" do
  position 10
  mode :match_all
end

# Match traffic without blocking it.
policy "watch-https" do
  chain :monitoring, position: 10
  where { proto == "tcp" && dst_port == 443 }
  action :observe
  note "Review HTTPS traffic before adding a block."
end

flowruby 1.1

# Give a group of devices a reusable name.
# Replace this example MAC with your device's MAC.
mac_set "kids", members: %w[aa:bb:cc:dd:ee:01]

policy_chain "main" do
  position 10
  mode :first_match
end

# Both conditions must match: the app AND the device.
policy "kids-video" do
  chain :main, position: 10
  where {
    app.in?(["YouTube", "Netflix"]) &&
      subscriber_id.in_set?("kids")
  }
  action :drop
end

flowruby 1.1

# Lower positions run first inside this chain.
policy_chain "main" do
  position 10
  mode :first_match
end

# Leave this app alone within this chain.
policy "video-exception" do
  chain :main, position: 10
  where { app == "YouTube" }
  action :observe
end

# The exception above wins for YouTube.
policy "block-video" do
  chain :main, position: 20
  where { app.in?(["YouTube", "Netflix"]) }
  action :drop
end

flowruby 1.1

policy_chain "main" do
  position 10
  mode :first_match
end

# A repeating evening rule, Monday through Friday.
policy "evening-video" do
  chain :main, position: 10
  where { app.in?(["YouTube", "Netflix"]) }
  action :drop

  # 9 PM to 7 AM; times use the explicit UTC offset.
  schedule days: %w[mon tue wed thu fri],
           start: "21:00", end: "07:00",
           utc_offset: 5
end

flowruby 1.1

policy_chain "main" do
  position 10
  mode :first_match
end

# A one-off rule that expires automatically.
policy "focus-session" do
  chain :main, position: 10
  where { app == "YouTube" }
  action :drop

  # Example dates: replace with your own UTC window.
  starts_at  "2027-01-10T09:00:00Z"
  expires_at "2027-01-10T11:00:00Z"
  enabled true
  note "Two hours of focus; created by your agent."
end

flowruby 1.1

# Use an unused customer ID for your own app label.
app "Team Portal" do
  id 4097
  slug "team-portal"
  category "custom"
end

# Relabel matching TLS traffic so policies can name it.
flow_relabel "team-portal-label" do
  priority 30
  where { app == "tls" && hostname == "portal.example.com" }
  set_app "Team Portal"
end

policy_chain "main" do
  position 10
  mode :first_match
end

policy "watch-team-portal" do
  chain :main, position: 10
  where { app == "Team Portal" }
  action :observe
end