OK, I know what you mean now. In some other models such as TD-W8960, this is supported.

1. You can change CWMP port to other port e.g. 65534 in CWMP page, then port 7547 may work with DMZ. 2. Maybe you mean "Port Triggering".

AFAIK, it just supports keywords, so ".tumblr.com" will block "www.tumblr.com", "fetish.tumblr.com", also "www.tumblr.com.uk".

Maybe nf_conntrack_count is not the reason, because sometimes it reached higher than 2000. Could u tell me your environment, u use PPPoE, IPoE, PPPoA or IPoA, have you used other functions like wifi,...