diff --git a/luci-app-eqosplus b/luci-app-eqosplus
deleted file mode 160000
index c7ea61c9..00000000
--- a/luci-app-eqosplus
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c7ea61c971f123b59282131ea5b3438e39118dae
diff --git a/luci-app-eqosplus/.github/workflows/main.yml b/luci-app-eqosplus/.github/workflows/main.yml
new file mode 100644
index 00000000..3258ec29
--- /dev/null
+++ b/luci-app-eqosplus/.github/workflows/main.yml
@@ -0,0 +1,47 @@
+name: Build
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  build:
+    name: Build ${{ matrix.arch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - aarch64_generic
+          - i386_pentium-mmx
+          - loongarch64_generic
+          - mips_mips32
+          - mipsel_24kc
+          - mipsel_mips32
+          - x86_64
+    steps:
+      - uses: actions/checkout@main
+        with:
+          fetch-depth: 0
+      - name: Building packages
+        uses: sbwml/openwrt-gh-action-sdk@go1.24
+        env:
+          ARCH: ${{ matrix.arch }}-openwrt-24.10
+          FEEDNAME: packages_ci
+          PACKAGES: luci-app-eqosplus
+          NO_REFRESH_CHECK: true
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.arch }}
+          path: bin/packages/${{ matrix.arch }}/packages_ci/*.ipk
+
+      - name: Upload packages
+        uses: ncipollo/release-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          allowUpdates: true
+          replacesArtifacts: true
+          artifacts: "bin/packages/${{ matrix.arch }}/packages_ci/*.ipk"
diff --git a/luci-app-eqosplus/LICENSE b/luci-app-eqosplus/LICENSE
new file mode 100644
index 00000000..574c7ac3
--- /dev/null
+++ b/luci-app-eqosplus/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 sirpdboy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/luci-app-eqosplus/Makefile b/luci-app-eqosplus/Makefile
new file mode 100644
index 00000000..91e501b7
--- /dev/null
+++ b/luci-app-eqosplus/Makefile
@@ -0,0 +1,39 @@
+#
+# Copyright (C) 2006-2017 OpenWrt.org#
+# Copyright (C) 2022-2025 sirpdboy herboy2008@gmail.com https://github.com/sirpdboy/luci-app-eqosplus
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+THEME_NAME:=eqosplus
+PKG_NAME:=luci-app-$(THEME_NAME)
+
+PKG_LICENSE:=Apache-2.0
+
+LUCI_TITLE:=LuCI support for eqosplus.
+LUCI_DESCRIPTION:=LuCI support for Easy eqosplus(Support speed limit based on IP address).
+LUCI_DEPENDS:=+ip-full +tc +nftables +bc +kmod-ifb
+LUCI_PKGARCH:=all
+
+PKG_VERSION:=1.3.0
+PKG_RELEASE:=20251128
+PKG_MAINTAINER:=sirpdboy <herboy2008@gmail.com>
+
+define Build/Compile
+endef
+
+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+rm -f /tmp/luci-*
+endef
+
+define Package/$(PKG_NAME)/conffiles
+/etc/config/eqosplus
+endef
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
diff --git a/luci-app-eqosplus/README.md b/luci-app-eqosplus/README.md
new file mode 100644
index 00000000..d2707f57
--- /dev/null
+++ b/luci-app-eqosplus/README.md
@@ -0,0 +1,91 @@
+![hello](https://views.whatilearened.today/views/github/sirpdboy/deplives.svg) [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+
+<h1 align="center">
+  <br>luci-app-eqosplus<br>
+</h1>
+
+<p align="center">
+<a href="https://openwrt.org"><img alt="OpenWrt" src="https://img.shields.io/badge/OpenWrt-%E2%89%A519.07-ff0000?logo=openwrt&logoColor=white"></a>
+<a href="https://www.google.com/chrome/"><img alt="Chrome" src="https://img.shields.io/badge/Chrome-%E2%89%A5111-4285F3?logo=googlechrome&logoColor=white"></a>
+<a href="https://www.apple.com/safari/"><img alt="Safari" src="https://img.shields.io/badge/Safari-%E2%89%A516.4-000000?logo=safari&logoColor=white"></a>
+<a href="https://www.mozilla.org/firefox/"><img alt="Firefox" src="https://img.shields.io/badge/Firefox-%E2%89%A5128-FF7138?logo=firefoxbrowser&logoColor=white"></a>
+<a target="_blank" href="https://github.com/sirpdboy/luci-app-eqosplus/releases"> <img alt="GitHub release" src="https://img.shields.io/github/v/release/sirpdboy/luci-app-eqosplus"></a>
+<a href="https://github.com/sirpdboy/luci-app-eqosplus/releases"><img alt="Downloads" src="https://img.shields.io/github/downloads/sirpdboy/luci-app-eqosplus/total"></a>
+</p>
+
+[中文] | [English](README.md) 
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明1.jpg)
+
+Please read this page carefully, which includes precautions and instructions on how to use it.
+
+## Enhanced version of EQOS with timed speed limit and added features such as timed limit.
+
+### Method for downloading source code:
+
+ ```Brach
+    # downloading
+    git clone https://github.com/sirpdboy/luci-app-eqosplus package/luci-app-eqosplus
+    make menuconfig
+ ``` 
+### Configuration Menu
+ ```Brach
+    make menuconfig
+	# find LuCI -> Applications, select luci-app-eqosplus, save and exit
+ ``` 
+### compile
+
+ ```Brach 
+    # compile
+    make package/luci-app-eqosplus/compile V=s
+ ```
+
+
+## describe
+
+- luci-app-eqosplus ： https://github.com/sirpdboy/luci-app-eqosplus
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明2.jpg)
+
+
+## interface
+
+![screenshots](./doc/eqosplus0.png)
+
+![screenshots](./doc/eqosplus1.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus2.png)
+
+
+# My other project
+
+- Watch Dog ： https://github.com/sirpdboy/luci-app-watchdog
+- Net Speedtest ： https://github.com/sirpdboy/luci-app-netspeedtest
+- Task Plan : https://github.com/sirpdboy/luci-app-taskplan
+- Power Off Device : https://github.com/sirpdboy/luci-app-poweroffdevice
+- OpentoPD Theme : https://github.com/sirpdboy/luci-theme-opentopd
+- KuCat Theme : https://github.com/sirpdboy/luci-theme-kucat
+- KuCat Theme Config : https://github.com/sirpdboy/luci-app-kucat-config
+- NFT Time Control : https://github.com/sirpdboy/luci-app-timecontrol
+- Parent Control: https://github.com/sirpdboy/luci-theme-parentcontrol
+- Eqos Plus: https://github.com/sirpdboy/luci-app-eqosplus
+- Advanced : https://github.com/sirpdboy/luci-app-advanced
+- ddns-go : https://github.com/sirpdboy/luci-app-ddns-go
+- Advanced Plus）: https://github.com/sirpdboy/luci-app-advancedplus
+- Net Wizard: https://github.com/sirpdboy/luci-app-netwizard
+- Part Exp: https://github.com/sirpdboy/luci-app-partexp
+- Lukcy: https://github.com/sirpdboy/luci-app-lukcy
+
+## HELP
+
+|     <img src="https://img.shields.io/badge/-Alipay-F5F5F5.svg" href="#赞助支持本项目-" height="25" alt="图飞了"/>  |  <img src="https://img.shields.io/badge/-WeChat-F5F5F5.svg" height="25" alt="图飞了" href="#赞助支持本项目-"/>  | 
+| :-----------------: | :-------------: |
+|![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/支付宝.png) | ![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/微信.png) |
+
+<a href="#readme">
+    <img src="https://img.shields.io/badge/-TOP-orange.svg" alt="no" title="Return TOP" align="right"/>
+</a>
+
+![hello](https://visitor-badge-deno.deno.dev/sirpdboy.sirpdboy.svg) [![](https://img.shields.io/badge/TGGroup-ClickJoin-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
diff --git a/luci-app-eqosplus/README_CN.md b/luci-app-eqosplus/README_CN.md
new file mode 100644
index 00000000..8da16627
--- /dev/null
+++ b/luci-app-eqosplus/README_CN.md
@@ -0,0 +1,109 @@
+![hello](https://views.whatilearened.today/views/github/sirpdboy/deplives.svg) [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+
+<h1 align="center">
+  <br>luci-app-eqosplus<br>
+</h1>
+
+  <p align="center">
+
+  <a target="_blank" href="https://github.com/sirpdboy/luci-app-eqosplus/releases">
+    <img src="https://img.shields.io/github/release/sirpdboy/luci-app-eqosplus.svg?style=flat-square&label=luci-app-eqosplus&colorB=green">
+  </a>
+</p>
+
+[中文] | [English](README.md) 
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明1.jpg)
+
+请 **认真阅读完毕** 本页面，本页面包含注意事项和如何使用。
+
+## 功能说明：
+
+### 定时限速1.2.2版
+#### 2023.7.19 定时限速1.2.2：增加更多日期：工作日和休息日，自定义日期1，2，3中间用逗号分隔;加入MAC地址限速，从此不用担心IPV6和IPV4的限速问题。
+
+### 定时限速1.0版
+#### 2022.12.24 定时限速在eqos的加强版，加入定时限制等功能。
+
+## 编译使用方法 [![](https://img.shields.io/badge/-编译使用方法-F5F5F5.svg)](#编译使用方法-)
+
+将luci-app-eqosplus添加至 LEDE/OpenWRT 源码的方法。
+
+### 下载源码方法一：
+编辑源码文件夹根目录feeds.conf.default并加入如下内容:
+
+```Brach
+    # feeds获取源码：
+    src-git eqosplus  https://github.com/sirpdboy/luci-app-eqosplus
+ ``` 
+  ```Brach
+   # 更新feeds，并安装主题：
+    scripts/feeds update eqosplus
+	scripts/feeds install luci-app-eqosplus
+ ``` 	
+
+### 下载源码方法：
+ ```Brach
+    # 下载源码
+    git clone https://github.com/sirpdboy/luci-app-eqosplus package/luci-app-eqosplus
+    make menuconfig
+ ``` 
+### 配置菜单
+ ```Brach
+    make menuconfig
+	# 找到 LuCI -> Applications, 选择 luci-app-eqosplus, 保存后退出。
+ ``` 
+### 编译
+ ```Brach 
+    # 编译固件
+    make package/luci-app-eqosplus/compile V=s
+ ```
+
+## 说明 [![](https://img.shields.io/badge/-说明-F5F5F5.svg)](#说明-)
+
+源码来源：https://github.com/sirpdboy/luci-app-eqosplus
+
+
+- 你可以随意使用其中的源码，但请注明出处。
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明2.jpg)
+
+## 界面
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus2.png)
+
+# My other project
+
+- 路由安全看门狗 ：https://github.com/sirpdboy/luci-app-watchdog
+- 网络速度测试 ：https://github.com/sirpdboy/luci-app-netspeedtest
+- 计划任务插件（原定时设置） : https://github.com/sirpdboy/luci-app-taskplan
+- 关机功能插件 : https://github.com/sirpdboy/luci-app-poweroffdevice
+- opentopd主题 : https://github.com/sirpdboy/luci-theme-opentopd
+- kucat酷猫主题: https://github.com/sirpdboy/luci-theme-kucat
+- kucat酷猫主题设置工具: https://github.com/sirpdboy/luci-app-kucat-config
+- NFT版上网时间控制插件: https://github.com/sirpdboy/luci-app-timecontrol
+- 家长控制: https://github.com/sirpdboy/luci-theme-parentcontrol
+- 定时限速: https://github.com/sirpdboy/luci-app-eqosplus
+- 系统高级设置 : https://github.com/sirpdboy/luci-app-advanced
+- ddns-go动态域名: https://github.com/sirpdboy/luci-app-ddns-go
+- 进阶设置（系统高级设置+主题设置kucat/agron/opentopd）: https://github.com/sirpdboy/luci-app-advancedplus
+- 网络设置向导: https://github.com/sirpdboy/luci-app-netwizard
+- 一键分区扩容: https://github.com/sirpdboy/luci-app-partexp
+- lukcy大吉: https://github.com/sirpdboy/luci-app-lukcy
+
+## 捐助
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明3.jpg)
+
+|     <img src="https://img.shields.io/badge/-支付宝-F5F5F5.svg" href="#赞助支持本项目-" height="25" alt="图飞了"/>  |  <img src="https://img.shields.io/badge/-微信-F5F5F5.svg" height="25" alt="图飞了" href="#赞助支持本项目-"/>  | 
+| :-----------------: | :-------------: |
+|![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/支付宝.png) | ![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/微信.png) |
+
+<a href="#readme">
+    <img src="https://img.shields.io/badge/-返回顶部-orange.svg" alt="图飞了" title="返回顶部" align="right"/>
+</a>
+
+![](https://visitor-badge-deno.deno.dev/sirpdboy.sirpdboy.svg)  [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+
diff --git a/luci-app-eqosplus/doc/eqosplus0.png b/luci-app-eqosplus/doc/eqosplus0.png
new file mode 100644
index 00000000..978f4abd
Binary files /dev/null and b/luci-app-eqosplus/doc/eqosplus0.png differ
diff --git a/luci-app-eqosplus/doc/eqosplus1.png b/luci-app-eqosplus/doc/eqosplus1.png
new file mode 100644
index 00000000..c603fcda
Binary files /dev/null and b/luci-app-eqosplus/doc/eqosplus1.png differ
diff --git a/luci-app-eqosplus/luasrc/controller/eqosplus.lua b/luci-app-eqosplus/luasrc/controller/eqosplus.lua
new file mode 100644
index 00000000..cbe01b70
--- /dev/null
+++ b/luci-app-eqosplus/luasrc/controller/eqosplus.lua
@@ -0,0 +1,19 @@
+module("luci.controller.eqosplus", package.seeall)
+-- Copyright 2022-2023 sirpdboy <herboy2008@gmail.com>
+function index()
+    if not nixio.fs.access("/etc/config/eqosplus") then return end
+    entry({"admin", "control"}, firstchild(), "Control", 44).dependent = false
+
+    local e = entry({"admin", "control", "eqosplus"}, cbi("eqosplus"), _("Eqosplus"), 10)
+    e.dependent=false
+    e.acl_depends = { "luci-app-eqosplus" }
+    entry({"admin", "control", "eqosplus", "status"}, call("act_status")).leaf = true
+end
+
+function act_status()
+    local sys  = require "luci.sys"
+    local e = {} 
+     e.status = sys.call(" busybox ps -w | grep eqosplus | grep -v grep  >/dev/null ") == 0  
+    luci.http.prepare_content("application/json")
+    luci.http.write_json(e)
+end
diff --git a/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua b/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua
new file mode 100644
index 00000000..32c3433c
--- /dev/null
+++ b/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua
@@ -0,0 +1,190 @@
+-- Copyright 2022-2023 sirpdboy <herboy2008@gmail.com>
+-- Licensed to the public under the Apache License 2.0.
+local sys = require "luci.sys"
+local ifaces = sys.net:devices()
+local WADM = require "luci.tools.webadmin"
+local ipc = require "luci.ip"
+local a, t, e
+
+a = Map("eqosplus", translate("Network speed limit"))
+a.description = translate("Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second.")
+a.template = "eqosplus/index"
+
+t = a:section(TypedSection, "eqosplus")
+t.anonymous = true
+
+e = t:option(DummyValue, "eqosplus_status", translate("Status"))
+e.template = "eqosplus/eqosplus"
+e.value = translate("Collecting data...")
+
+
+ipi = t:option(ListValue, "ifname", translate("Interface"), translate("Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"))
+ipi.default = "1"
+ipi:value(1,translate("Automatic settings"))
+ipi:value("br-lan", translate("br-lan (LAN Bridge)"))
+local function get_wan_interfaces()
+    local result = {}
+    local ubus = require "ubus"
+    
+    local conn = ubus.connect()
+    if not conn then
+        return result
+    end
+
+    local network_status = conn:call("network.interface", "dump", {})
+    for _, iface in ipairs(network_status.interface) do
+        if iface.interface:match("^wan") or iface.interface:match("^pppoe") or iface.proto == "pppoe" then
+            local dev = iface.l3_device or iface.device
+            if dev then
+                table.insert(result, {
+                    name = dev,
+                    proto = iface.proto,
+                    logical_name = iface.interface
+                })
+            end
+        end
+    end
+
+    conn:close()
+    return result
+end
+
+local wan_ifaces = get_wan_interfaces()
+for _, iface in ipairs(wan_ifaces) do
+    ipi:value(iface.name, translate(iface.name) .. (iface.proto == "pppoe" and " (PPPoE)" or " (WAN)"))
+end
+
+t = a:section(TypedSection, "device")
+t.template = "cbi/tblsection"
+t.anonymous = true
+t.addremove = true
+
+comment = t:option(Value, "comment", translate("Comment"))
+comment.size = 8
+
+e = t:option(Flag, "enable", translate("Enabled"))
+e.rmempty = false
+e.size = 4
+
+ip = t:option(Value, "mac", translate("IP/MAC"))
+ip.size = 8
+
+local function get_devices()
+    local devices = {}
+    local seen_ips = {}
+    local ubus = require "ubus"
+    local conn = ubus.connect()
+    
+    local function get_hostname(ip)
+        local f = io.popen("nslookup "..ip.." 2>/dev/null | grep 'name =' | cut -d'=' -f2 | sed 's/\\.$//'")
+        if f then
+            local name = f:read("*l")
+            f:close()
+            if name and name ~= "" then
+                return name:match("^%s*(.-)%s*$")
+            end
+        end
+        local leases_file = io.open("/tmp/dhcp.leases", "r")
+        if leases_file then
+            for line in leases_file:lines() do
+                local mac, ip_lease, _, hostname = line:match("^(%S+)%s+(%S+)%s+(%S+)%s+(%S+)")
+                if ip_lease == ip and hostname ~= "*" then
+                    leases_file:close()
+                    return hostname
+                end
+            end
+            leases_file:close()
+        end
+       return "unknown"
+    end
+    if conn then
+        local leases = conn:call("dhcp", "ipv4leases", {}) or {}
+        for _, lease in ipairs(leases) do
+            if lease.ipaddr and lease.mac then
+                local hostname = lease.hostname or get_hostname(lease.ipaddr)
+                devices[#devices+1] = {
+                    ip = lease.ipaddr,
+                    mac = lease.mac:upper(),
+                    hostname = hostname,
+                    display = string.format("%s (%s) - %s", lease.ipaddr, lease.mac:upper(), hostname)
+                }
+                seen_ips[lease.ipaddr] = true
+            end
+        end
+        conn:close()
+    end
+    local arp_cmd = io.popen("ip -4 neigh show dev br-lan 2>/dev/null")
+    if arp_cmd then
+        for line in arp_cmd:lines() do
+            local ip_addr, mac = line:match("^(%S+)%s+.+%s+(%S+)%s+")
+            if ip_addr and mac and mac ~= "00:00:00:00:00:00" and not seen_ips[ip_addr] then
+                mac = mac:upper()
+                local hostname = get_hostname(ip_addr)
+                devices[#devices+1] = {
+                    ip = ip_addr,
+                    mac = mac,
+                    hostname = hostname,
+                    display = string.format("%s (%s) - %s", ip_addr, mac, hostname)
+                }
+                seen_ips[ip_addr] = true
+            end
+        end
+        arp_cmd:close()
+    end
+    table.sort(devices, function(a, b) return a.ip < b.ip end)
+    return devices
+end
+
+local devices = get_devices()
+for _, dev in ipairs(devices) do
+    ip:value(dev.ip, dev.display)
+end
+dl = t:option(Value, "download", translate("Downloads"))
+dl.default = '0.1'
+dl.size = 4
+
+ul = t:option(Value, "upload", translate("Uploads"))
+ul.default = '0.1'
+ul.size = 4
+function validate_time(self, value, section)
+        local hh, mm, ss
+        hh, mm, ss = string.match (value, "^(%d?%d):(%d%d)$")
+        hh = tonumber (hh)
+        mm = tonumber (mm)
+        if hh and mm and hh <= 23 and mm <= 59 then
+            return value
+        else
+            return nil, "Time HH:MM or space"
+        end
+end
+
+e = t:option(Value, "timestart", translate("Start control time"))
+e.placeholder = '00:00'
+e.default = '00:00'
+e.validate = validate_time
+e.rmempty = true
+e.size = 4
+
+e = t:option(Value, "timeend", translate("Stop control time"))
+e.placeholder = '00:00'
+e.default = '00:00'
+e.validate = validate_time
+e.rmempty = true
+e.size = 4
+
+week=t:option(Value,"week",translate("Week Day(1~7)"))
+week.rmempty = true
+week:value('0',translate("Everyday"))
+week:value(1,translate("Monday"))
+week:value(2,translate("Tuesday"))
+week:value(3,translate("Wednesday"))
+week:value(4,translate("Thursday"))
+week:value(5,translate("Friday"))
+week:value(6,translate("Saturday"))
+week:value(7,translate("Sunday"))
+week:value('1,2,3,4,5',translate("Workday"))
+week:value('6,7',translate("Rest Day"))
+week.default='0'
+week.size = 6
+
+return a
diff --git a/luci-app-eqosplus/luasrc/view/eqosplus/eqosplus.htm b/luci-app-eqosplus/luasrc/view/eqosplus/eqosplus.htm
new file mode 100644
index 00000000..4445143f
--- /dev/null
+++ b/luci-app-eqosplus/luasrc/view/eqosplus/eqosplus.htm
@@ -0,0 +1,3 @@
+<%+cbi/valueheader%>
+<font class="eqosplus_status"><%=pcdata(self:cfgvalue(section) or self.default or "")%></font>
+<%+cbi/valuefooter%>
\ No newline at end of file
diff --git a/luci-app-eqosplus/luasrc/view/eqosplus/index.htm b/luci-app-eqosplus/luasrc/view/eqosplus/index.htm
new file mode 100644
index 00000000..c4b8a072
--- /dev/null
+++ b/luci-app-eqosplus/luasrc/view/eqosplus/index.htm
@@ -0,0 +1,12 @@
+<% include("cbi/map") %>
+<script type="text/javascript">//<![CDATA[
+	XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "control", "eqosplus", "status" )%>', null,
+		function (x, result) {
+			var status = document.getElementsByClassName('eqosplus_status')[0];
+			status.setAttribute("style", "font-weight:bold;");
+			status.setAttribute("color", result.status ? "green" : "red");
+			status.innerHTML = result.status ? '<%=translate("RUNNING")%>' : '<%=translate("NOT RUNNING")%>';
+		}
+	)
+//]]>
+</script>
\ No newline at end of file
diff --git a/luci-app-eqosplus/po/templates/eqosplus.pot b/luci-app-eqosplus/po/templates/eqosplus.pot
new file mode 100644
index 00000000..151cee8d
--- /dev/null
+++ b/luci-app-eqosplus/po/templates/eqosplus.pot
@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr ""
+
+msgid "Network speed limit"
+msgstr ""
+
+msgid "Running state"
+msgstr ""
+
+msgid "Not running"
+msgstr ""
+
+msgid "Running"
+msgstr ""
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second."
+msgstr ""
+
+msgid "MAC/IP"
+msgstr ""
+
+msgid "Downloads"
+msgstr ""
+
+msgid "Uploads"
+msgstr ""
+
+msgid "Comment"
+msgstr ""
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr ""
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr ""
+
+msgid "Start control time"
+msgstr ""
+
+msgid "Stop control time"
+msgstr ""
+
+msgid "Week Day(1~7)"
+msgstr ""
+
+msgid "Suggested feedback:"
+msgstr ""
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr ""
+
+msgid "Rest Day"
+msgstr ""
+
+msgid "Workday"
+msgstr ""
+
+msgid "Automatic settings"
+msgstr ""
+
diff --git a/luci-app-eqosplus/po/zh-cn/eqosplus.po b/luci-app-eqosplus/po/zh-cn/eqosplus.po
new file mode 100644
index 00000000..0fa56393
--- /dev/null
+++ b/luci-app-eqosplus/po/zh-cn/eqosplus.po
@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr "定时限速"
+
+msgid "Network speed limit"
+msgstr "定时网速限制"
+
+msgid "Running state"
+msgstr "运行状态"
+
+msgid "Not running"
+msgstr "未运行"
+
+msgid "Running"
+msgstr "已运行"
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP.The speed unit is MB/second."
+msgstr "可以通过MAC，IP限制用户上传/下载的网速。速度单位为<font color=\"red\"><b> MB/秒 </b></font>。"
+
+msgid "MAC/IP"
+msgstr "MAC/IP"
+
+msgid "Downloads"
+msgstr "下载速度"
+
+msgid "Uploads"
+msgstr "上传速度"
+
+msgid "Comment"
+msgstr "备注"
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr "上传总带宽(Mbit/s)"
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr "下载总带宽(Mbit/s)"
+
+msgid "Start control time"
+msgstr "起控时间"
+
+msgid "Stop control time"
+msgstr "停控时间"
+
+msgid "Week Day(1~7)"
+msgstr "星期(1~7)"
+
+msgid "Suggested feedback:"
+msgstr "建议反馈:"
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr "设定用来限制网络速度的接口,拨号使用pppoe-wan,DHCP模式使用WAN口的硬件接口(如:eth1),通用使用br-lan接口"
+
+msgid "Rest Day"
+msgstr "休息日"
+
+msgid "Workday"
+msgstr "工作日"
+
+msgid "Automatic settings"
+msgstr "自动设置"
+
diff --git a/luci-app-eqosplus/po/zh_Hans/eqosplus.po b/luci-app-eqosplus/po/zh_Hans/eqosplus.po
new file mode 100644
index 00000000..840559fc
--- /dev/null
+++ b/luci-app-eqosplus/po/zh_Hans/eqosplus.po
@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr "定时限速"
+
+msgid "Network speed limit"
+msgstr "定时网速限制"
+
+msgid "Running state"
+msgstr "运行状态"
+
+msgid "Not running"
+msgstr "未运行"
+
+msgid "Running"
+msgstr "已运行"
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second."
+msgstr "用户可以通过MAC、IP、IP段（192.168.10.100-192.168.10.200),限制上传/下载的网络速度。速度单位为MB/秒。。"
+
+msgid "MAC/IP"
+msgstr "MAC/IP"
+
+msgid "Downloads"
+msgstr "下载速度"
+
+msgid "Uploads"
+msgstr "上传速度"
+
+msgid "Comment"
+msgstr "备注"
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr "上传总带宽(Mbit/s)"
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr "下载总带宽(Mbit/s)"
+
+msgid "Start control time"
+msgstr "起控时间"
+
+msgid "Stop control time"
+msgstr "停控时间"
+
+msgid "Week Day(1~7)"
+msgstr "星期(1~7)"
+
+msgid "Suggested feedback:"
+msgstr "建议反馈:"
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr "设定用来限制网络速度的接口,拨号使用pppoe-wan,DHCP模式使用WAN口的硬件接口(如:eth1),通用使用br-lan接口"
+
+msgid "Rest Day"
+msgstr "休息日"
+
+msgid "Workday"
+msgstr "工作日"
+
+msgid "Automatic settings"
+msgstr "自动设置"
+
diff --git a/luci-app-eqosplus/root/etc/config/eqosplus b/luci-app-eqosplus/root/etc/config/eqosplus
new file mode 100644
index 00000000..722434ae
--- /dev/null
+++ b/luci-app-eqosplus/root/etc/config/eqosplus
@@ -0,0 +1,25 @@
+
+config eqosplus
+	option enabled '0'
+	option download '1000'
+	option upload '30'
+	option ifname '1'
+
+config device
+	option timestart '00:00'
+	option week '0'
+	option download '1'
+	option timeend '23:55'
+	option upload '1'
+	option mac '192.168.10.10'
+	option enable '0'
+
+config device
+	option mac '192.168.10.10-192.168.10.200'
+	option timestart '00:00'
+	option timeend '00:00'
+	option week '0'
+	option download '0.1'
+	option upload '0.1'
+	option enable '0'
+
diff --git a/luci-app-eqosplus/root/etc/hotplug.d/iface/10-eqosplus b/luci-app-eqosplus/root/etc/hotplug.d/iface/10-eqosplus
new file mode 100644
index 00000000..91059ec8
--- /dev/null
+++ b/luci-app-eqosplus/root/etc/hotplug.d/iface/10-eqosplus
@@ -0,0 +1,5 @@
+#!/bin/sh
+[ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ] && {
+    sleep 5
+    /etc/init.d/eqosplus restart
+}
\ No newline at end of file
diff --git a/luci-app-eqosplus/root/etc/init.d/eqosplus b/luci-app-eqosplus/root/etc/init.d/eqosplus
new file mode 100644
index 00000000..f74b5fdd
--- /dev/null
+++ b/luci-app-eqosplus/root/etc/init.d/eqosplus
@@ -0,0 +1,54 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (C) 2025 sirpdboy herboy2008@gmail.com https://github.com/sirpdboy/luci-app-eqosplus
+#
+
+START=99
+USE_PROCD=1
+
+NAME=eqosplus
+LOCK="/var/lock/$NAME.lock"
+CR=/etc/crontabs/root
+
+start_instance() {
+	 procd_open_instance
+	 procd_set_param command /usr/bin/eqosplusctrl
+	 procd_set_param respawn
+	 procd_set_param stderr 1
+	 procd_close_instance
+}
+
+_eqosplus_start() {
+	 if [ "$(grep -c 'option enable .1.' /etc/config/$NAME 2>/dev/null)" -gt "0" ]; then
+	 if [ x$(uci -q get turboacc.config.sw_flow) = 'x1' ] || [ x$(uci -q get turboacc.config.sfe_flow) = 'x1' ]  ;then
+	         uci -q set turboacc.config.sw_flow='0'
+	         uci -q set turboacc.config.sfe_flow='0'
+		 uci -q set turboacc.config.hw_flow='0'
+		 uci commit turboacc
+		 /etc/init.d/turboacc restart
+	  fi
+	    touch $LOCK
+	    eqosplus start
+	    start_instance
+	    (crontab -l ; echo "00 1 * * * /etc/init.d/eqosplus start") | sort - | uniq - | crontab -
+	 fi
+}
+
+start_service(){
+	[ -f $LOCK ] && exit
+	stop_service
+	_eqosplus_start
+	rm -f $LOCK
+}
+
+service_triggers() {
+ 	 procd_add_reload_trigger 'eqosplus'
+}
+
+stop_service(){
+	kill -9 $(busybox ps -w | grep 'eqosplusctrl' | grep -v 'grep' | awk '{print $1}') >/dev/null 2>&1
+	sed -i '/eqosplus/d' $CR >/dev/null 2>&1
+	rm -f $LOCK 2>/dev/null
+	eqosplus stop
+}
+
diff --git a/luci-app-eqosplus/root/etc/uci-defaults/luci-eqosplus b/luci-app-eqosplus/root/etc/uci-defaults/luci-eqosplus
new file mode 100644
index 00000000..f22cd0c6
--- /dev/null
+++ b/luci-app-eqosplus/root/etc/uci-defaults/luci-eqosplus
@@ -0,0 +1,13 @@
+#!/bin/sh
+chmod +x  /etc/init.d/eqosplus /usr/bin/eqosplus*
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@eqosplus[-1]
+	add ucitrack eqosplus
+	set ucitrack.@eqosplus[-1].init=eqosplus
+	commit ucitrack
+EOF
+
+[ -s /etc/config/eqosplus ] || echo "config eqosplus" > /etc/config/eqosplus
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/luci-app-eqosplus/root/usr/bin/eqosplus b/luci-app-eqosplus/root/usr/bin/eqosplus
new file mode 100644
index 00000000..721fafa0
--- /dev/null
+++ b/luci-app-eqosplus/root/usr/bin/eqosplus
@@ -0,0 +1,379 @@
+#!/bin/bash
+
+# Copyright (C) 2006 OpenWrt.org
+# Copyright 2022-2025 sirpdboy <herboy2008@gmail.com>
+
+crrun=$1
+crid=$2
+NAME=eqosplus
+IDLIST="/var/$NAME.idlist"
+LOCK="/var/lock/$NAME.lock"
+TMPID="/var/$NAME.tmpid"
+LOG="/var/$NAME_log.log"
+# idlist=`uci show $NAME | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' `
+
+
+if [ x$(uci get $NAME.@$NAME[0].ifname 2>/dev/null) = 'x1' ]; then
+    ifname=$(uci -q get network.lan.ifname)
+    [ "x$ifname" = "x" ] && ifname="device" || ifname="ifname"
+    dev=$(uci -q get network.wan.$ifname)
+    [ ! "$dev" ] && dev=br-lan
+else
+    dev=$(uci -q get $NAME.@$NAME[0].ifname 2>/dev/null)
+    [ ! "$dev" ] && dev=br-lan
+fi
+
+bin_nft=$(which nft)
+bin_tc=$(which tc)
+bin_ip=$(which ip)
+DEBUG=1
+
+nft_type() {
+    if command -v nft >/dev/null; then
+        nftables_ver="true"
+    fi
+}
+
+# Debug functions
+dbg_nft() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: nft $*"
+    $bin_nft "$@"
+}
+
+dbg_tc() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: tc $*"
+    $bin_tc "$@"
+}
+
+dbg_ip() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: ip $*"
+    $bin_ip "$@"
+}
+
+is_macaddr() {
+    ret=1
+    if echo "$1" | grep -qE '^([0-9A-Fa-f]{2}[-:]){5}[0-9A-Fa-f]{2}$'; then
+        ret=0
+    fi
+    return $ret
+}
+
+# 数值比较函数
+is_gt_zero() {
+    local value=$1
+    # 使用bc进行浮点数比较
+    echo "$value > 0" | bc -l 2>/dev/null | grep -q 1
+}
+
+# 转换为kbit
+to_kbit() {
+    local mb=$1
+    # MB/s 转 kbit/s: 1 MB/s = 8192 kbit/s
+    echo "scale=0; $mb * 8192 / 1" | bc 2>/dev/null || echo "0"
+}
+
+# Default commands
+tc="dbg_tc"
+ip="dbg_ip"
+nft="dbg_nft"
+
+nft_type
+
+stop_qos() {
+    for face in $(tc qdisc show 2>/dev/null | grep htb | awk '{print $5}'); do
+        $tc qdisc del dev $face root 2>/dev/null
+    done
+
+    $tc qdisc del dev ${dev} root 2>/dev/null
+    $tc qdisc del dev ${dev}_ifb root 2>/dev/null
+    $tc qdisc del dev ${dev} ingress 2>/dev/null
+        $ip link del dev ${dev}_ifb 2>/dev/null 2>&1
+
+    if [ -n "$nftables_ver" ]; then
+        $nft delete table inet ${NAME} 2>/dev/null
+        $nft delete table bridge ${NAME} 2>/dev/null
+    fi
+
+    echo "" > "$IDLIST" 2>/dev/null
+}
+
+init_qosplus() {
+
+    insmod sch_htb 2>/dev/null
+    insmod act_mirred 2>/dev/null
+    insmod ifb 2>/dev/null
+    
+    $ip link del dev ${dev}_ifb 2>/dev/null
+    $ip link add dev ${dev}_ifb name ${dev}_ifb type ifb
+    $ip link set dev ${dev}_ifb up
+
+    $tc qdisc del dev ${dev} root 2>/dev/null
+    $tc qdisc add dev ${dev} root handle 1:0 htb default 1
+    $tc class add dev ${dev} parent 1:0 classid 1:1 htb rate 1000mbit ceil 1000mbit
+    
+    $tc qdisc del dev ${dev}_ifb root 2>/dev/null
+    $tc qdisc add dev ${dev}_ifb root handle 1:0 htb default 1
+    $tc class add dev ${dev}_ifb parent 1:0 classid 1:1 htb rate 1000mbit ceil 1000mbit
+    lanipaddr=$(uci -q get network.lan.ipaddr 2>/dev/null | awk -F '.' '{print $1"."$2"."$3".0/24"}')
+    if [ -n "$lanipaddr" ]; then
+        $tc filter add dev $dev parent 1:0 protocol ip prio 1 u32 match ip src "$lanipaddr" match ip dst "$lanipaddr" flowid 1:1
+        $tc filter add dev ${dev}_ifb parent 1:0 protocol ip prio 1 u32 match ip src "$lanipaddr" match ip dst "$lanipaddr" flowid 1:1
+    fi
+    $tc qdisc del dev ${dev} ingress 2>/dev/null
+    $tc qdisc add dev ${dev} ingress
+    $tc filter add dev ${dev} parent ffff: protocol all prio 2 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev ${dev}_ifb
+
+    if [ -n "$nftables_ver" ]; then
+        $nft delete table inet ${NAME} 2>/dev/null
+        $nft delete table bridge ${NAME} 2>/dev/null
+        
+        $nft add table inet ${NAME}
+        
+        $nft add chain inet ${NAME} mark_forward { type filter hook forward priority -200\; policy accept\; }
+        $nft add chain inet ${NAME} mark_output { type filter hook output priority -200\; policy accept\; }
+        $nft add chain inet ${NAME} mark_postrouting { type filter hook postrouting priority -200\; policy accept\; }
+    fi
+    
+    return 0
+}
+
+
+del_id() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: del_id $@ --$id --$mac"
+    $tc filter del dev ${dev} parent 1: handle 800::$(printf "%x" $id) 2>/dev/null
+    $tc class del dev ${dev} parent 1:1 classid 1:$id 2>/dev/null
+    $tc filter del dev ${dev}_ifb parent 1: handle 800::$(printf "%x" $id) 2>/dev/null
+    $tc class del dev ${dev}_ifb parent 1:1 classid 1:$id 2>/dev/null
+    mac=$(uci -q get $NAME.@device[$list_id].mac 2>/dev/null)
+    if [ -n "$nftables_ver" ] && [ -n "$mac" ]; then
+        if is_macaddr "$mac"; then
+            $nft delete rule inet ${NAME} mark_forward ether saddr $mac counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_output ether saddr $mac counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_postrouting ether saddr $mac counter 2>/dev/null
+        else
+            Z=$(echo $mac | awk -F '[/]' '{print $2}')
+            [ -n "$Z" ] && mac=$(echo $mac | awk -F '[/]' '{print $1}') || Z=32
+            $nft delete rule inet ${NAME} mark_forward ip saddr $mac/$Z counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_output ip saddr $mac/$Z counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_postrouting ip saddr $mac/$Z counter 2>/dev/null
+        fi
+    fi
+}
+
+add_mac() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    M0=$(echo $mac | cut -d : -f 1)$(echo $mac | cut -d : -f 2)
+    M1=$(echo $mac | cut -d : -f 3)$(echo $mac | cut -d : -f 4)
+    M2=$(echo $mac | cut -d : -f 5)$(echo $mac | cut -d : -f 6)
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: add_mac $@ --id:$id --mac:$mac M012--$M0-$M1-$M2"
+
+    if is_gt_zero "$UL"; then
+        if [ -n "$nftables_ver" ]; then
+            $nft add rule inet ${NAME} mark_forward ether saddr $mac counter meta mark set $id
+            $nft add rule inet ${NAME} mark_output ether saddr $mac counter meta mark set $id
+            $nft add rule inet ${NAME} mark_postrouting ether saddr $mac counter meta mark set $id
+        fi
+        $tc class add dev ${dev}_ifb parent 1:1 classid 1:$id htb rate "${UL}kbit" ceil "${UL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev}_ifb parent 1:$id handle ${id}: sfq perturb 10
+
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $id handle $id fw flowid 1:$id
+
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $((id + 100)) u32 \
+            match u16 0x0800 0xFFFF at -2 \
+            match u16 0x${M2} 0xFFFF at -4 \
+            match u32 0x${M0}${M1} 0xFFFFFFFF at -8 \
+            flowid 1:$id
+    fi
+    if is_gt_zero "$DL"; then
+        $tc class add dev ${dev} parent 1:1 classid 1:$id htb rate "${DL}kbit" ceil "${DL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev} parent 1:$id handle ${id}: sfq perturb 10
+
+        $tc filter add dev ${dev} parent 1: protocol ip prio $id u32 \
+            match u16 0x0800 0xFFFF at -2 \
+            match u32 0x${M1}${M2} 0xFFFFFFFF at -12 \
+            match u16 0x${M0} 0xFFFF at -14 \
+            flowid 1:$id
+    fi
+}
+
+add_ip() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: add_ip $@ --$id --$mac"
+    
+    Z=$(echo $mac | awk -F '[/]' '{print $2}')
+    [ -n "$Z" ] && mac=$(echo $mac | awk -F '[/]' '{print $1}') || Z=32
+    if is_gt_zero "$UL"; then
+        if [ -n "$nftables_ver" ]; then
+            $nft add rule inet ${NAME} mark_forward ip saddr $mac/$Z counter meta mark set $id
+            $nft add rule inet ${NAME} mark_output ip saddr $mac/$Z counter meta mark set $id
+            $nft add rule inet ${NAME} mark_postrouting ip saddr $mac/$Z counter meta mark set $id
+        fi
+        $tc class add dev ${dev}_ifb parent 1:1 classid 1:$id htb rate "${UL}kbit" ceil "${UL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev}_ifb parent 1:$id handle ${id}: sfq perturb 10
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $id handle $id fw flowid 1:$id
+        $tc filter add dev ${dev}_ifb parent 1:0 prio $((id + 100)) protocol ip u32 \
+            match ip src "$mac"/"$Z" \
+            flowid 1:$id
+    fi
+    if is_gt_zero "$DL"; then
+        $tc class add dev ${dev} parent 1:1 classid 1:$id htb rate "${DL}kbit" ceil "${DL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev} parent 1:$id handle ${id}: sfq perturb 10
+        $tc filter add dev ${dev} parent 1:0 prio $id protocol ip u32 \
+            match ip dst "$mac"/"$Z" \
+            flowid 1:$id
+    fi
+}
+
+check_time() {
+    local start=$1
+    local end=$2
+    local current=$(date +%H%M)
+    local start_min=$((10#${start:0:2}*60 + 10#${start:3:2}))
+    local end_min=$((10#${end:0:2}*60 + 10#${end:3:2}))
+    local current_min=$((10#${current:0:2}*60 + 10#${current:2:2}))
+    
+    if [[ $start_min -lt $end_min ]]; then
+        [[ $current_min -ge $start_min && $current_min -lt $end_min ]]
+    else
+        [[ $current_min -ge $start_min || $current_min -lt $end_min ]]
+    fi
+}
+
+check_list() {
+    local i=$1
+    local start_time=$(uci -q get $NAME.@device[$i].timestart 2>/dev/null)
+    local end_time=$(uci -q get $NAME.@device[$i].timeend 2>/dev/null)
+    local wweek=$(uci -q get $NAME.@device[$i].week 2>/dev/null)
+    local current_weekday=$(date +%u)
+    [ -z "$start_time" ] && [ -z "$end_time" ] && [ -z "$wweek" ] && return 0
+    
+    if [ -n "$wweek" ] && [ "$wweek" != "0" ]; then
+        local day_match=0
+        for day in $(echo $wweek | tr ',' ' '); do
+            [ "$day" -eq "$current_weekday" ] && day_match=1 && break
+        done
+        [ "$day_match" -eq 0 ] && return 1
+    fi
+    
+    if [ -n "$start_time" ] && [ -n "$end_time" ]; then
+        check_time "$start_time" "$end_time" || return 1
+    fi
+    
+    return 0
+}
+
+case "$crrun" in
+    "stop")
+        stop_qos
+    ;;
+    "start")
+        stop_qos > /dev/null 2>&1
+        sleep 2
+        init_qosplus
+        idlist=$(uci show $NAME 2>/dev/null | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' | sort -nu | sed -e 's/^/!/g' -e 's/$/!/g' > $IDLIST; cat $IDLIST 2>/dev/null | sed -e 's/!//g')
+        
+        if [ ! -s "$IDLIST" ]; then
+            return 1
+        fi
+
+        device_count=0
+        for list in $(echo $idlist | sed -e 's/!//g'); do
+            if check_list $list; then
+                mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+                download_mb=$(uci -q get $NAME.@device[$list].download 2>/dev/null)
+                upload_mb=$(uci -q get $NAME.@device[$list].upload 2>/dev/null)
+                comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+                
+                # 转换为kbit
+                DL=$(to_kbit "$download_mb")
+                UL=$(to_kbit "$upload_mb")
+                
+                if [ -n "$mac" ]; then
+                    if is_macaddr "$mac"; then
+                        add_mac $list  >>$LOG
+                        echo "✅ MAC限速: $comment ($mac) - 下载:${download_mb}MB/s(${DL}kbit/s) 上传:${upload_mb}MB/s(${UL}kbit/s)"  >>$LOG
+                    else
+                        add_ip $list  >>$LOG
+                        echo "✅ IP限速: $comment ($mac) - 下载:${download_mb}MB/s(${DL}kbit/s) 上传:${upload_mb}MB/s(${UL}kbit/s)"  >>$LOG
+                    fi
+                    device_count=$((device_count + 1))
+                fi
+            else
+                [ -f "$IDLIST" ] && [ $(grep "!${list}!" "$IDLIST" 2>/dev/null | wc -l) -gt 0 ] && {
+                    del_id $list  >>$LOG
+                    sed -i "/!$list!/d" "$IDLIST" >/dev/null 2>&1
+                    comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+                }
+            fi
+        done
+        echo "EQOSPLUS限速服务启动完成，共配置 $device_count 个设备"  >>$LOG
+        echo ""
+        echo "当前限速状态:"   >>$LOG
+        tc -s class show dev $dev | grep "rate" | head -5   >>$LOG
+        tc -s class show dev ${dev}_ifb | grep "rate" | head -5   >>$LOG
+
+    ;;
+    "add")
+        echo "➕ 添加限速规则..."
+        for list in $(echo $crid | sed -e 's/!//g' | sed 's/,/ /g'); do
+            mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+            download_mb=$(uci -q get $NAME.@device[$list].download 2>/dev/null)
+            upload_mb=$(uci -q get $NAME.@device[$list].upload 2>/dev/null)
+            comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+            DL=$(to_kbit "$download_mb")
+            UL=$(to_kbit "$upload_mb")
+            
+            if is_macaddr $mac; then
+                add_mac $list
+                echo "✅ 添加MAC限速: $comment ($mac)" >>$LOG
+            else
+                add_ip $list
+                echo "✅ 添加IP限速: $comment ($mac)" >>$LOG
+            fi
+        done
+    ;;
+    "del")
+        for list in $(echo $crid | sed -e 's/!//g' | sed 's/,/ /g'); do 
+            comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+            mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+            del_id $list
+        done
+    ;;
+    "status")
+        echo "EQOSPLUS限速服务状态"
+        echo "### 网络接口: $dev ###"
+        echo "# 下载队列统计 #"
+        tc -s qdisc show dev $dev 2>/dev/null || echo "无下载队列"
+        echo "# 下载类统计 #"
+        tc -s class show dev $dev 2>/dev/null | grep -E "class htb|rate [0-9]" || echo "无下载类"
+        echo "# 下载过滤器 #"
+        tc -s filter show dev $dev parent 1: 2>/dev/null | head -10 || echo "无下载过滤器"
+        
+        echo "### 虚拟接口: ${dev}_ifb ###"
+        echo "# 上传队列统计 #"
+        tc -s qdisc show dev ${dev}_ifb 2>/dev/null || echo "无上传队列"
+        echo "# 上传类统计 #"
+        tc -s class show dev ${dev}_ifb 2>/dev/null | grep -E "class htb|rate [0-9]" || echo "无上传类"
+        echo "# 上传过滤器 #"
+        tc -s filter show dev ${dev}_ifb parent 1: 2>/dev/null | head -10 || echo "无上传过滤器"
+        
+        if [ -n "$nftables_ver" ]; then
+            echo "### NFTables规则 ###"
+            nft list table inet ${NAME} 2>/dev/null || echo "没有NFTables规则"
+        else
+            echo "NFTables不可用"
+        fi
+        
+        # 显示流量统计
+        echo "### 流量统计 ###"
+        echo "下载流量:"
+        tc -s class show dev $dev 2>/dev/null | grep "Sent" | head -5
+        echo "上传流量:"
+        tc -s class show dev ${dev}_ifb 2>/dev/null | grep "Sent" | head -5
+    ;;
+
+esac
\ No newline at end of file
diff --git a/luci-app-eqosplus/root/usr/bin/eqosplusctrl b/luci-app-eqosplus/root/usr/bin/eqosplusctrl
new file mode 100644
index 00000000..9b5721d6
--- /dev/null
+++ b/luci-app-eqosplus/root/usr/bin/eqosplusctrl
@@ -0,0 +1,63 @@
+#!/bin/sh
+
+# Copyright (C) 2006 OpenWrt.org
+# Copyright 2022-2025 sirpdboy <herboy2008@gmail.com>
+NAME=eqosplus
+IDLIST="/var/$NAME.idlist"
+TMPID="/var/$NAME.tmpid"
+
+idlist=`uci show $NAME | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' `
+
+check_list() {
+	i=$1
+	checki='0'
+	start_time=$(uci -q get $NAME.@device[$i].timestart 2>/dev/null)
+	end_time=$(uci -q get $NAME.@device[$i].timeend 2>/dev/null)
+	wweek=`uci -q get $NAME.@device[$i].week `
+	current_time=$(date +%H:%M)
+	current_weekday=$(date +%u)
+	for ww in `echo $wweek | sed 's/,/ /g' `; do 
+		if [ $current_weekday = $ww ] || [ 'x0' = x$ww ] ;then 
+		       [ "$start_time" = "$end_time" ] && checki='1' || { 
+		       	   if  [ "$start_time" \< "$end_time" ]; then
+			       if  [ "$current_time" \> "$start_time" ]  &&  [ "$current_time" \< "$end_time" ] ; then
+		       	           checki='1'
+		       	       fi
+		       	   else 
+			       if [ "$start_time" \> "$end_time" ] ; then
+			          if [ "$current_time" \< "$start_time" ] && [ "$current_time" \> "$end_time" ] ; then
+		       	              checki='1'
+		       	          fi
+			       fi
+			   fi
+		       	}
+		fi
+	done
+	return
+}
+
+idlistusr(){
+   checki='0'
+   [ -s $IDLIST ] || touch $IDLIST
+   for list in $idlist ;do
+	check_list $list
+	if [ $checki == '1' ] ; then
+	     [ `cat $IDLIST  2>/dev/null | grep "!${list}!" | wc -l ` -gt 0 ] || { 
+	         eqosplus add $list
+	         echo "!${list}!" >> $IDLIST ;  cat $IDLIST | sort | uniq  > $TMPID ;cat $TMPID >$IDLIST ;rm -rf $TMPID
+	     }
+        else
+	     [ `cat $IDLIST  2>/dev/null | grep "!${list}!" | wc -l ` -gt 0 ] && {
+	         eqosplus del $list
+		 sed -i "/!$list!/d" $IDLIST >/dev/null 2>&1
+	     }
+	fi
+   done
+}
+
+
+while :;do
+	sleep 30
+	idlistusr
+	sleep 30
+done
\ No newline at end of file
diff --git a/luci-app-eqosplus/root/usr/share/rpcd/acl.d/luci-app-eqosplus.json b/luci-app-eqosplus/root/usr/share/rpcd/acl.d/luci-app-eqosplus.json
new file mode 100644
index 00000000..b879f4de
--- /dev/null
+++ b/luci-app-eqosplus/root/usr/share/rpcd/acl.d/luci-app-eqosplus.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-eqosplus": {
+		"description": "Grant UCI access for luci-app-eqosplus",
+		"read": {
+			"uci": [ "eqosplus" ]
+		},
+		"write": {
+			"uci": [ "eqosplus" ]
+		}
+	}
+}
diff --git a/luci-app-eqosplus/界面.png b/luci-app-eqosplus/界面.png
new file mode 100644
index 00000000..d346c698
Binary files /dev/null and b/luci-app-eqosplus/界面.png differ
diff --git a/luci-theme-footstrap/htdocs/luci-static/resources/fs-chrome.js b/luci-theme-footstrap/htdocs/luci-static/resources/fs-chrome.js
index f94292f3..d9ee203c 100644
--- a/luci-theme-footstrap/htdocs/luci-static/resources/fs-chrome.js
+++ b/luci-theme-footstrap/htdocs/luci-static/resources/fs-chrome.js
@@ -282,8 +282,8 @@ function fitChrome() {
 	 * 123px on owrt2512 at 767px — 107px of growth a floor never sees, on top of the shrink it does
 	 * — each step landing between two of the poll's own separate section refreshes, so the browser
 	 * paints in between and the reader is moved by exactly as much, on Chromium and Firefox as well
-	 * as Safari (`tools/fit-quiet.mjs`, `../tmp/task-toplayout/pass-probe.mjs`). `min-height` alone
-	 * was measured to `accc451`'s WebKit-only diagnosis instead — WebKit's own scroll anchoring
+	 * as Safari (`tools/fit-quiet.mjs`, plus a probe that pauses the layout mid-pass). `min-height`
+	 * alone was measured to `accc451`'s WebKit-only diagnosis instead — WebKit's own scroll anchoring
 	 * looked like the whole story only because it is the one engine with no anchoring at all to hide
 	 * this walk behind; Chromium and Firefox absorb it the same way they absorb any other layout
 	 * change, which is not the same as not producing it.
@@ -585,8 +585,8 @@ return baseclass.extend({
 		 * resize is exactly what starts that window (fs-fit.js's resize observer feeds the same
 		 * motion sampler `scrolling()` reads). A caller landing in that window, most of all
 		 * fs-select's, got the width the PREVIOUS viewport had: at 568px settling to 390px, model
-		 * stayed 568 for up to 220ms of the 400 (measured: −178px, exactly 568−390;
-		 * ../tmp/task-vnstat/probe2.mjs, probe3.mjs; live-audit's `geometry|fs-content` finding on
+		 * stayed 568 for up to 220ms of the 400 (measured: −178px, exactly 568−390, against a probe
+		 * resizing the window mid-settle, and live-audit's `geometry|fs-content` finding on
 		 * owrt2410, CI run 34364446910).
 		 *
 		 * So the window's own width is compared fresh on every call, not only when `_shellOuter`
diff --git a/luci-theme-footstrap/htdocs/luci-static/resources/fs-router.js b/luci-theme-footstrap/htdocs/luci-static/resources/fs-router.js
index d65f2bcd..4c088a8f 100644
--- a/luci-theme-footstrap/htdocs/luci-static/resources/fs-router.js
+++ b/luci-theme-footstrap/htdocs/luci-static/resources/fs-router.js
@@ -485,10 +485,10 @@ function restoreScroll(pos, gen) {
 	 * anywhere in the document, while THIS one is still waiting for its content to grow tall enough —
 	 * used to read as "the reader scrolled" and cancel the whole restore, killing the axis that WAS
 	 * legitimately pending over one that was never being restored at all. Reproduced without a real
-	 * router (`../tmp/task-back/repro2.mjs`): a bare `window.scrollTo(0, 111)` from an unrelated
-	 * script while the sidebar layout's `#maincontent` restore was still pending left the reader at 0
-	 * for the rest of the 5 s window instead of the parked 3000; scoping the check to the axis `pos`
-	 * carries fixes it, samples unchanged (3000).
+	 * router: a bare `window.scrollTo(0, 111)` from an unrelated script while the sidebar layout's
+	 * `#maincontent` restore was still pending left the reader at 0 for the rest of the 5 s window
+	 * instead of the parked 3000; scoping the check to the axis `pos` carries fixes it, samples
+	 * unchanged (3000).
 	 *
 	 * A SAME-axis false alarm survives that fix: the browser's OWN traversal restore lands on the
 	 * scroller BEFORE this handler swaps `#view` (see the comment above the function), and the swap
@@ -1235,9 +1235,9 @@ function navigate(pathname, push, kbd) {
 				 * than at the click, where it used to sit — means the reader keeps reading the
 				 * OUTGOING page from wherever they were for the whole staging window instead of
 				 * being thrown to its top the moment they click. Measured with the require held open
-				 * (1.2 s, ../tmp/task-navflash/navflash-slow.mjs): `y` used to hit 0 within 12 ms of
-				 * the click and stay there through the swap; moved here it stays at the reader's own
-				 * offset for the whole window and reaches 0 in the same frame the new page appears.
+				 * (1.2 s): `y` used to hit 0 within 12 ms of the click and stay there through the
+				 * swap; moved here it stays at the reader's own offset for the whole window and
+				 * reaches 0 in the same frame the new page appears.
 				 * docs/anchoring.md, "The scroll reset". */
 				if (push) {
 					window.scrollTo(0, 0);
diff --git a/luci-theme-footstrap/root/etc/uci-defaults/30_luci-theme-footstrap b/luci-theme-footstrap/root/etc/uci-defaults/30_luci-theme-footstrap
index bbb12c32..b0ad9376 100755
--- a/luci-theme-footstrap/root/etc/uci-defaults/30_luci-theme-footstrap
+++ b/luci-theme-footstrap/root/etc/uci-defaults/30_luci-theme-footstrap
@@ -30,15 +30,20 @@ fi
 # The pattern is deliberately NOT symlinked into /www: an SVG is a document, and served as one
 # through a plain same-origin URL it runs as a script with the admin's session (OpenWrt forum
 # thread 251930). It is instead read by cgi-bin/luci-theme-footstrap-pattern, which answers with
-# CSP 'none' + sandbox and nosniff — headers uhttpd cannot attach to a static file. The login
-# background stays a plain symlink: fs-assets.js re-encodes every upload to a JPEG on a canvas
-# first, so there is no script grammar left in the bytes for a direct hit to run.
+# CSP 'none' + sandbox and nosniff — headers uhttpd cannot attach to a static file. It needs its
+# .svg name to paint at all, so octet-stream is not open to it.
+#
+# The login background stays a plain symlink, and NOT because of what the browser did to the
+# bytes: the ACL authorises the cgi-upload POST whatever wrote it, so fs-assets.js's canvas
+# re-encode is compression and EXIF removal, not a boundary (it says so itself). What keeps a
+# direct open inert is the extension-less name — uhttpd types the response by extension and
+# answers application/octet-stream, which a browser downloads instead of running as a document.
 mkdir -p /etc/footstrap
 if [ -d /www/luci-static/footstrap ]; then
 	ln -sf /etc/footstrap/login-bg /www/luci-static/footstrap/bg
 	ln -sfn /etc/footstrap/fonts /www/luci-static/footstrap/fonts
 fi
-# Clean up a pre-0.15 install's stale pattern symlink — see the header comment above for why this
+# Clean up a pre-0.14.11 install's stale pattern symlink — see the header comment above for why this
 # is the one migration this script makes. `-L` only: never remove a real file some other install
 # step could have left at that path.
 [ -L /www/luci-static/footstrap/pattern.svg ] && rm -f /www/luci-static/footstrap/pattern.svg
diff --git a/luci-theme-footstrap/styles/pages/20-overview.css b/luci-theme-footstrap/styles/pages/20-overview.css
index 959a8d86..503a050e 100644
--- a/luci-theme-footstrap/styles/pages/20-overview.css
+++ b/luci-theme-footstrap/styles/pages/20-overview.css
@@ -42,6 +42,8 @@
 	 * 14 h3 on live 24.10.8 — not dead there, that release has no hide/show control */
 	:is(.cbi-title h3, .cbi-section > h3)[role="button"] {
 		cursor: pointer;
+		-webkit-user-select: none;	/* every shipped Safari/iOS reads only the prefixed form */
+		user-select: none;			/* rapid header clicks read as a double-click and select the card */
 		border-radius: var(--fs-radius-sm);
 	}
 	:is(.cbi-title h3, .cbi-section > h3)[role="button"]:focus-visible {
diff --git a/oxidns/files/config.yaml b/oxidns/files/config.yaml
index a189e93c..edd98292 100644
--- a/oxidns/files/config.yaml
+++ b/oxidns/files/config.yaml
@@ -1,9 +1,24 @@
+# ==============================================================================
+# 部署位置：家庭网关/软路由（10.0.10.2），统一接管内网 DNS 请求
+# 核心职责：
+#   1) 国内域名 → 走 DoH/UDP 国内上游（腾讯/阿里/火山）
+#   2) 国外域名 → 转发给 Clash (:1053) 走代理出网
+#   3) 广告/恶意域名 → 直接黑洞 (NXDOMAIN)
+#   4) 微软 NCSI 等连通性检测域名 → 强制走国内序列，避免误判"断网"
+#   5) HTTPS RR (qtype=65) → 走国外序列，让 ECH/DoH 走代理
+# ==============================================================================
+
 log:
+  # 日志级别：trace / debug / info / warn / error
   level: info
-  file: /tmp/run/oxidns/oxidns.log
+  # 日志文件路径（相对路径以 oxiDNS 运行目录为准）
+  file: ./oxidns.log
   rotation:
-    type: weekly
-    max_files: 1
+    # 按天切割日志，避免单文件过大
+    type: daily
+    # 保留最近 3 个日志文件，超出自动清理
+    max_files: 3
+
 api:
   http:
     listen: 0.0.0.0:9199
@@ -14,183 +29,327 @@ api:
     webui:
       root: /usr/share/oxidns/webui
       index: index.html
+
 plugins:
-  - tag: download_main
-    type: download
-    args:
-      downloads:
-        - url: https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/proxy-list.txt
-          dir: /etc/oxidns/rules
-          filename: proxy-list.txt
-        - url: https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt
-          dir: /etc/oxidns/rules
-          filename: gfw.txt
-        - url: https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/reject-list.txt
-          dir: /etc/oxidns/rules
-          filename: reject-list.txt
-        - url: https://anti-ad.net/easylist.txt
-          dir: /etc/oxidns/rules
-          filename: easylist.txt
-      timeout: 30s
-      startup_if_missing: true
-
-  - tag: proxy_domains
-    type: domain_set
-    args:
-      files:
-        - /etc/oxidns/rules/proxy-list.txt
-        - /etc/oxidns/rules/gfw.txt
-
-  - tag: ad_rules
-    type: adguard_rule
-    args:
-      files:
-        - /etc/oxidns/rules/reject-list.txt
-        - /etc/oxidns/rules/easylist.txt
-
-  - tag: reload_download_rules
-    type: reload_provider
-    args:
-      - $proxy_domains
-      - $ad_rules
-
-  - tag: subscription_refresh
-    type: sequence
-    args:
-      - exec: $download_main
-      - exec: $reload_download_rules
-
-  - tag: subscription_cron
+  # ---------------------------------------------------------------------------
+  # 定时任务：每天定时下载规则并热加载（无需重启进程）
+  # ---------------------------------------------------------------------------
+  - tag: cron_update
     type: cron
     args:
       timezone: Asia/Shanghai
       jobs:
-        - name: refresh_download_rules
-          interval: 168h
+        - name: update_rules
+          interval: 1d
           executors:
-            - $subscription_refresh
+            - $download_rules   # 先下载最新规则
+            - $reload_rules     # 再热加载 provider，避免下载过程中规则不一致
 
-  - tag: local_hosts
+  # ---------------------------------------------------------------------------
+  # 规则下载：广告/安全列表 + GeoIP/GeoSite 地理位置数据
+  # ---------------------------------------------------------------------------
+  - tag: download_rules
+    type: download
+    args:
+      timeout: 180s             # 单个文件下载超时时间
+      startup_if_missing: true  # 启动时若本地缺少规则文件则立即补拉
+      downloads:
+        # ---------- 广告 / 隐私保护规则 ----------
+        # anti-ad.net：中文站点优化，国内直连可达
+        - url: https://anti-ad.net/adguard.txt
+          dir: /etc/oxidns/rules
+          filename: antiad.txt
+        # OISD Basic：综合广告/追踪列表，big.oisd.nl 国内直连可达
+        - url: https://big.oisd.nl
+          dir: /etc/oxidns/rules
+          filename: oisd_big.txt
+        # Hagezi 系列：统一走 jsDelivr CDN，国内访问更稳定
+        - url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/ultimate.mini.txt
+          dir: /etc/oxidns/rules
+          filename: hagezi_ultimate_mini.txt
+        - url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/popupads.txt
+          dir: /etc/oxidns/rules
+          filename: hagezi_popupads.txt
+        - url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/hoster.txt
+          dir: /etc/oxidns/rules
+          filename: hagezi_hoster.txt
+        - url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/doh.txt
+          dir: /etc/oxidns/rules
+          filename: hagezi_doh.txt
+        # ---------- 地理位置数据 ----------
+        # Loyalsoldier/v2ray-rules-dat：GeoSite 域名分类（cn / geolocation-!cn）
+        - url: https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat
+          dir: /etc/oxidns/rules
+          filename: geosite.dat
+        # Loyalsoldier/geoip：仅含中国大陆 + 私有网段
+        - url: https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip-only-cn-private.dat
+          dir: /etc/oxidns/rules
+          filename: geoip.dat
+
+  # ---------------------------------------------------------------------------
+  # 热加载：下载完成后重载以下 provider，无需重启 oxiDNS
+  # ---------------------------------------------------------------------------
+  - tag: reload_rules
+    type: reload_provider
+    args:
+      - $ad_rules        # 广告规则
+      - $security_rules  # 安全规则
+      - $geoip_cn        # 国内 IP
+      - $geosite_cn      # 国内域名
+      - $geosite_no_cn   # 非国内域名
+      - $ms_ncsi_white   # 微软 NCSI 白名单
+
+  # ---------------------------------------------------------------------------
+  # Prometheus 指标收集（供 Prometheus / Grafana 抓取）
+  # ---------------------------------------------------------------------------
+  - tag: metrics_main
+    type: metrics_collector
+    args:
+      name: home   # 指标名前缀：home_*
+
+  # ---------------------------------------------------------------------------
+  # 查询记录：落 SQLite，供 WebUI 查询/分析/排障
+  # ---------------------------------------------------------------------------
+  - tag: recorder_main
+    type: query_recorder
+    args:
+      path: /etc/oxidns/rules/query_history.sqlite
+      retention_days: 7   # 只保留最近 7 天，自动清理
+
+  # ---------------------------------------------------------------------------
+  # 规则 Provider：把 AdGuard 格式规则加载成内存 matcher
+  # ---------------------------------------------------------------------------
+  # 广告规则：偏"展示型广告 / 弹窗"拦截
+  - tag: ad_rules
+    type: adguard_rule
+    args:
+      files:
+        - /etc/oxidns/rules/antiad.txt
+        - /etc/oxidns/rules/hagezi_popupads.txt
+
+  # 安全规则：偏"恶意 / 钓鱼 / 追踪 / 恶意托管商 / DoH 滥用"拦截
+  - tag: security_rules
+    type: adguard_rule
+    args:
+      files:
+        - /etc/oxidns/rules/oisd_big.txt
+        - /etc/oxidns/rules/hagezi_ultimate_mini.txt
+        - /etc/oxidns/rules/hagezi_hoster.txt
+        - /etc/oxidns/rules/hagezi_doh.txt
+
+  # ---------------------------------------------------------------------------
+  # 地理位置 Provider：用于 IP / 域名分流判断
+  # ---------------------------------------------------------------------------
+  # 中国大陆 + 私有网段 IP
+  - tag: geoip_cn
+    type: geoip
+    args:
+      file: /etc/oxidns/rules/geoip.dat
+      selectors:
+        - cn
+      country: true   # 按国家代码匹配
+
+  # 中国大陆域名（geosite-cn 分类）
+  - tag: geosite_cn
+    type: geosite
+    args:
+      file: /etc/oxidns/rules/geosite.dat
+      selectors:
+        - cn
+
+  # 非中国大陆域名（geolocation-!cn）
+  - tag: geosite_no_cn
+    type: geosite
+    args:
+      file: /etc/oxidns/rules/geosite.dat
+      selectors:
+        - geolocation-!cn
+
+  # ---------------------------------------------------------------------------
+  # 微软 NCSI 连通性探测域名白名单
+  # 这些域名必须能解析到任意可达 IP，否则 Windows 会判定"无网络"
+  # 因此强制走国内上游，不走代理
+  # ---------------------------------------------------------------------------
+  - tag: ms_ncsi_white
+    type: domain_set
+    args:
+      files: []
+      domains:
+        - msftconnecttest.com
+        - msftncsi.com
+        - ipv6.msftconnecttest.com
+        - www.msftconnecttest.com
+        - www.msftncsi.com
+
+  # ---------------------------------------------------------------------------
+  # 本地 hosts（可手工写死某些解析，目前为空，预留）
+  # ---------------------------------------------------------------------------
+  - tag: hosts
     type: hosts
     args:
-      entries:
-        - translate.googleapis.com 120.26.207.106
-        - translate-pa.googleapis.com 120.26.207.106
-        - share.dmhy.org 172.67.98.15
-      short_circuit: true
+      files: []
 
-  - tag: blocked
-    type: sequence
-    args:
-      - exec: "black_hole 0.0.0.0 ::"
-      - exec: accept
-
-  - tag: cache_main
+  # ---------------------------------------------------------------------------
+  # 缓存：分国内/国外两个实例，避免互相污染、TTL 策略也不同
+  # ---------------------------------------------------------------------------
+  # 国内缓存：容量较大，TTL 较激进（国内上游稳定）
+  - tag: cache_direct
     type: cache
     args:
-      size: 8192
+      size: 8192                      # LRU 容量
+      short_circuit: true             # 命中缓存直接返回，不再走下游
+      lazy_cache_ttl: 3600            # 懒加载 TTL（秒）
+      cache_negative: true            # 缓存 NXDOMAIN 等否定应答
+      max_negative_ttl: 60            # 否定应答最长缓存
+      negative_ttl_without_soa: 10    # 无 SOA 的否定应答 TTL
+      max_positive_ttl: 3600          # 强制上限（防上游 TTL 过长）
+      min_positive_ttl: 5             # 强制下限（防上游 TTL 过短）
+      ecs_in_key: false               # 不把 ECS 写入 key（家庭场景无需按子网区分）
+      dump_file: /etc/oxidns/rules/dns_cache_direct.dump  # 退出时持久化
+      dump_interval: 1800             # 每 30 分钟周期性 dump
+
+  # 国外缓存：容量略小，TTL 更保守（依赖 OpenClash 出口）
+  - tag: cache_remote
+    type: cache
+    args:
+      size: 4096
       short_circuit: true
+      lazy_cache_ttl: 3600
       cache_negative: true
-  - tag: prefer_ipv4_main
-    type: prefer_ipv4
+      max_negative_ttl: 30
+      negative_ttl_without_soa: 10
+      max_positive_ttl: 3600
+      min_positive_ttl: 5
+      ecs_in_key: false
+      dump_file: /etc/oxidns/rules/dns_cache_remote.dump
+      dump_interval: 1800
+
+  # ---------------------------------------------------------------------------
+  # 广告黑洞：命中广告/安全规则时直接 NXDOMAIN
+  # ---------------------------------------------------------------------------
+  - tag: ad_blackhole
+    type: black_hole
     args:
-      cache: true
-      cache_ttl: 3600
-  - tag: forward_local
+      rcode: 3   # 3 = NXDOMAIN
+
+  # ---------------------------------------------------------------------------
+  # 上游转发：分国内 / OpenClash 两条
+  # ---------------------------------------------------------------------------
+  # 国内上游：并发查询 + prefer_positive，避免单一上游故障
+  - tag: forward_cn
     type: forward
     args:
-      concurrent: 2
+      concurrent: 3                       # 同时向 3 个上游发，取最快正响应
+      response_selection: prefer_positive # 有正响应优先，避免被否定应答"误杀"
       upstreams:
-        - tag: alidns_dns
-          addr: https://223.5.5.5/dns-query
-          port: 443
+        # 腾讯 DoH：dial_addr 写死 IP，防止 DoH 域名递归解析死锁
+        - tag: doh_tencent
+          addr: https://doh.pub/dns-query
+          dial_addr: 1.12.12.12
+          idle_timeout: 30
+          insecure_skip_verify: false
+          timeout: 5s
+        # 阿里 DoH：开启 HTTP/3 加速
+        - tag: doh_alibaba
+          addr: https://dns.alidns.com/dns-query
+          dial_addr: 223.5.5.5
           idle_timeout: 30
-          max_conns: 256
           insecure_skip_verify: false
           timeout: 5s
-          enable_pipeline: false
           enable_http3: true
-        - tag: dnspod_dns
-          addr: https://1.12.12.12/dns-query
-          port: 443
+        # 火山 UDP：传统 UDP 53 作为备用
+        - tag: udp_volcengine
+          addr: 180.184.1.1:53
           idle_timeout: 30
-          max_conns: 256
-          insecure_skip_verify: false
-          timeout: 5s
-          enable_pipeline: false
-          enable_http3: false
-      short_circuit: true
-  - tag: forward_remote
+          timeout: 3s
+
+  # 国外上游：交给 OpenClash 的 DNS 转发端口
+  #   OpenClash 内部会做 FakeIP + 代理出网
+  - tag: forward_openclash
     type: forward
     args:
-      concurrent: 2
       upstreams:
-        - tag: google_dns
-          addr: https://8.8.8.8/dns-query
-          port: 443
-          idle_timeout: 30
-          max_conns: 256
-          insecure_skip_verify: false
-          timeout: 3s
-          enable_http3: false
-        - tag: cloudflare_dns
-          addr: https://1.1.1.1/dns-query
-          port: 443
-          idle_timeout: 30
-          max_conns: 256
-          insecure_skip_verify: false
-          enable_http3: false
-      short_circuit: true
-  - tag: forward_remote_proxy
-    type: forward
+        - tag: openclash_dns
+          addr: 127.0.0.1:1053
+          timeout: 8s
+
+  # ---------------------------------------------------------------------------
+  # 三段子序列：每段都是 "cache → upstream → 兜底"
+  # ---------------------------------------------------------------------------
+  # NCSI 子序列：仅给微软 NCSI 域名用，强制走国内上游保证"有网"
+  - tag: ncsi_seq
+    type: sequence
     args:
-      concurrent: 2
-      upstreams:
-        - tag: google_dns
-          addr: https://8.8.8.8/dns-query
-          port: 443
-          socks5: 10.0.0.1:1080
-          idle_timeout: 30
-          max_conns: 256
-          insecure_skip_verify: false
-          timeout: 3s
-          enable_http3: false
-        - tag: cloudflare_dns
-          addr: https://1.1.1.1/dns-query
-          port: 443
-          socks5: 10.0.0.1:1080
-          idle_timeout: 30
-          max_conns: 256
-          insecure_skip_verify: false
-          enable_http3: false
-      short_circuit: true
-  - tag: forward_remote_fallback_main
-    type: fallback
+      - exec: $cache_direct
+      - matches: has_resp   # 命中缓存直接返回
+        exec: accept
+      - exec: $forward_cn
+      - exec: accept         # 兜底：无论返回什么都接受（让 NCSI 通过）
+
+  # 国内子序列：缓存 → 国内上游 → 仅保留国内 IP → 丢境外 IP
+  - tag: local_seq
+    type: sequence
     args:
-      primary: forward_remote
-      secondary: forward_remote_proxy
-      threshold: 150
-      always_standby: true
-      short_circuit: true
+      - exec: $cache_direct
+      - matches: has_resp
+        exec: accept
+      - exec: $forward_cn
+      - matches: resp_ip $geoip_cn   # 响应 IP 必须属于中国大陆
+        exec: accept
+      - exec: drop_resp              # 否则丢弃（防境外 IP 污染/劫持）
+
+  # 国外子序列：缓存 → OpenClash → 直接接受
+  - tag: remote_seq
+    type: sequence
+    args:
+      - exec: $cache_remote
+      - matches: has_resp
+        exec: accept
+      - exec: $forward_openclash
+      - exec: accept
+
+  # ---------------------------------------------------------------------------
+  # 主序列：所有查询的统一入口（按优先级顺序匹配）
+  # ---------------------------------------------------------------------------
   - tag: main_sequence
     type: sequence
     args:
-      - exec: $local_hosts
-      - matches: question $ad_rules
-        exec: goto blocked
-      - exec: $cache_main
-      - exec: $prefer_ipv4_main
-      - matches: qname $proxy_domains
-        exec: $forward_remote_fallback_main
-      - matches: "!has_resp"
-        exec: $forward_local
+      - exec: $recorder_main              # 1) 全量记录查询日志（WebUI 可查）
+
+      - exec: $hosts                      # 2) hosts 优先
+      - matches: has_resp
+        exec: accept
+
+      - matches: qtype PTR                # 3) PTR 反向查询直接拒绝
+        exec: reject 3                    #    不向外泄露内网设备信息
+
+      - matches: qname $ms_ncsi_white     # 4) 微软 NCSI → 国内序列（保证"已联网"）
+        exec: goto ncsi_seq
+
+      - matches: qtype 65                 # 5) HTTPS RR (SVCB/HTTPS, type=65)
+        exec: goto remote_seq             #    让 ECH/DoH 引导信息走代理
+
+      - matches: qname $ad_rules          # 6) 广告域名 → 黑洞
+        exec: $ad_blackhole
+      - matches: qname $security_rules    # 7) 安全域名 → 黑洞
+        exec: $ad_blackhole
+
+      - matches: qname $geosite_cn        # 8) 国内站点 → 国内序列（含 GeoIP 校验）
+        exec: goto local_seq
+
+      - matches: qname $geosite_no_cn     # 9) 非国内站点 → 国外序列
+        exec: goto remote_seq
+
+      - exec: goto remote_seq             # 10) 兜底：未分类域名一律走国外
+                                         #     防止 DNS 泄露到国内上游
+
   - tag: udp_server
     type: udp_server
     args:
       entry: main_sequence
-      listen: :5353
+      listen: 127.0.0.1:5353
   - tag: tcp_server
     type: tcp_server
     args:
       entry: main_sequence
-      listen: :5353
+      listen: 127.0.0.1:5353
\ No newline at end of file