neighbor 127.0.0.1 {
	router-id 1.2.3.4;
	local-address 127.0.0.1;
	local-as 1;
	peer-as 1;
	group-updates false;

	family {
		ipv4 flow;
		ipv4 flow-vpn;
		ipv6 flow;
	}

	flow {
		route first-vpn-route {
			rd 65535:65536;
			match {
				source 10.0.0.1/32;
			}
			then {
				discard;
			}
		}
	}

	flow {
		route give-me-a-name {
			match {
				source 10.0.0.1/32;
				destination 10.0.0.2/32;
				destination-port =3128;
				protocol tcp;
			}
			then {
				discard;
				community [30740:0 30740:30740];
			}
		}

		route another { match { source 10.0.0.0/24; destination-port =3128; protocol tcp; } then { rate-limit 9600; } }

		route first-redirect {
			match {
				source 10.0.0.9/32;
				destination 192.168.0.1/32;
				port [ =80 =8080 ];
				destination-port [ >8080&<8088 =3128 ];
				source-port >1024;
				protocol [ udp tcp ];
			}
			then {
				redirect 65500:12345;
			}
		}

		route second-redirect {
			match {
				source 10.0.0.2/32;
				destination 192.168.0.1/32;
				port [ =80 =8080 ];
				destination-port [ >8080&<8088 =3128];
				source-port >1024;
				protocol [ udp tcp ];
			}
			then {
				# redirect 1.2.3.4:5678;
				# same as this one encoded as '8008 0102 0304 162E'
				redirect 258:33756718;
			}
		}

		route third-redirect {
			match {
				destination 192.168.0.1/32;
			}
			then {
				redirect 1.2.3.4;
			}
		}

		route legal-intercept {
			match {
				source 10.0.0.2/32;
			}
			then {
				copy 1.2.3.4;
			}
		}

		route a-vpn-route {
			rd 65535:65536;
			next-hop 5.6.7.8;
			match {
				source 10.0.0.3/32;
			}
			then {
				redirect-to-nexthop;
			}
		}

		route set-dscp {
			match {
				packet-length [ >200&<300 >400&<500 ];
			}
			then {
				mark 10;
			}
		}

		route take-action {
			match {
				fragment [ last-fragment ];
			}
			then {
				action sample-terminal;
			}
		}

		route ipv6 {
			match {
				source ::1/128/120;
				destination 2a02:b80:15::7aca:39ff:feae:a87a/128/0;
				next-header udp;
				traffic-class 101;
				flow-label 2013;
			}
			then {
				discard;
			}
		}

		route neq-operator {
			match {
				source 10.0.0.10/32;
				destination 192.168.0.1/32;
				port [ !=0 ];
				destination-port [ !=443 ];
				source-port [ !=80 !=8080 ];
				protocol [ !=tcp ];
			}
			then {
				discard;
			}
		}


		route check-tcp-flags {
			match {
				source 10.0.0.1/32;
				destination 10.0.0.2/32;
				destination-port =3128;
				protocol tcp;
				tcp-flags [SYN RST&FIN&!=push];  
			}
			then {
				discard;
			}
		}

	}
}
