OpenWrt has packages like some that can do broad qos. I’d like to do something more specific: rate limit (or deprioritize) an ipset. dnsmaq can build an ipset based on dns lookups, and I’d like to use it to rate limit things like OS updates. I figured out the dnsmasq bit, but I’m not sure what my options are for qos packages.
Use SQM with diffserv4 profile. Put dscp CS1 on packets to or from this ipset. You will need to set up sqm on egress of LAN side since iptables runs after ingress queue. See this recent thread for a veth based method Ultimate SQM settings: Layer_cake + DSCP marks