Choose some devices, such as a child's phone and a TV box, and block YouTube (or the whole internet) for them at set times, for example every night from midnight to 5 am. Other devices are not affected, and outside the times nothing is blocked.

At a glance:

Every step goes into the pending changes. Commit at the end, with the safety rollback on, and press Keep these settings.

Step 1: The time zone

System › Time & NTP › Time zone: choose your zone, for example America/Los_Angeles for Pacific time. Daylight saving time changes by itself. Schedules always mean the firewall's local time; with no time zone set, that is UTC.

Step 2: A fixed address for each device

The firewall recognises a device by its address, so every device in the group needs a DHCP reservation. In Network › DHCP server, the leases list shows each device's name, MAC address and current address. Under Reservations of your network, press Add reservation and enter the MAC address, the address it should always get, and a name. Save and commit; the device keeps that address from its next renewal (reconnect it to apply it at once).

Reserve an address outside the pool the DHCP server hands out (Address range of the network, for example .100–.220), so it can never be given to another device. In a failover pair, the reservations travel to the standby firewall with the configuration sync, so the devices keep their addresses after a failover.

Phones use a private Wi-Fi address (a random MAC). It stays the same for one Wi-Fi network as long as the phone is not set to rotate it (iPhone: Settings › Wi-Fi › (i) › Private Wi-Fi Address: Fixed; Android: Use randomised MAC stays the same per network unless "Non-persistent" is chosen).

Step 3: The group and the YouTube names

Firewall › Aliases & objects › Add address object:

1. The devices. Name Block_Phones_TVs. Under Entries, type the reserved addresses, for example 192.168.2.62 192.168.2.74 192.168.2.76, and press Add. Write in Description which device is which, since the table shows only the addresses. Save to pending changes.
2. YouTube. Name YouTube_Hosts. Under Entries, type the names YouTube uses: youtube.com www.youtube.com m.youtube.com youtu.be youtubei.googleapis.com youtube.googleapis.com i.ytimg.com s.ytimg.com yt3.ggpht.com youtube-nocookie.com www.youtube-nocookie.com, and press Add. Each name shows the addresses it resolves to; the firewall follows them when they change. Save to pending changes.

To remove a device later, open the group (pencil), click × next to its address, save, and commit.

Blocking by name stops the YouTube website and apps. It does not block other Google services, unlike blocking Google's address ranges, which would also stop search, Gmail and app stores.

Step 4: The schedule

Firewall › Schedules › Add schedule: name YouTube_Night, no days ticked (every day), Start time 00:00, End time 05:00. Save to pending changes.

An end time before the start time spans midnight: 22:00 to 06:00 runs from 10 pm to 6 am the next morning.

Step 5: The rule

Firewall › Rules › Add rule:

Save to pending changes.

Put the rule above the rules that allow traffic. Rules are checked from the top, and the first match decides. Open the rule's ⋮ menu, Move to position, type a position above the first allowing rule, and press Move. The rule checker warns "Part of the traffic … is matched first by rule #…" while the rule is too low.

Then commit, check that the internet still works, and press Keep these settings.

Block the whole internet instead

Use the same steps with Destination empty (any). The devices then have no internet during the schedule, but can still reach the local network.

Check it

• Hits in the rules table counts the blocked connections; with Log matches on, Monitoring › Logs & audit shows each one with the device.
• Outside the schedule the rule shows never hit or stops counting: nothing is blocked.

Troubleshooting