Actually I want to limit YouTube videos, but when I create a mangle rule with chain=prerouting protocol=tcp dst-port=443 action=mark-connection and using layer7 protocol with its regexp, it turns out that there are a lot of youtube videos that can't be captured, it's because these videos apparently already use "HTTP/3" protocol (since June 2020), even though there are 1 or 2 videos can be captured because they still use "HTTP/1" protocol.

And then I try to use protocol=udp instead of tcp, because afaik http/3 using udp, but the result is the same.

My YouTube RegExp = r[0-9]---[a-z]+-[a-z0-9]+-[a-z0-9]+\.googlevideo\.com
It works when a youtube video that i stream is using HTTP/1.

Has anyone try it before?

Youtube uses HTTPS. You can't see anything inside encrypted connections. Layer2 is useless against HTTPS

You can filter out YouTube DNS