This is all slowly starting to make more sense after sifting through 25+ pages of "Search: QoS" + 'Sort by date'.
"So if the policy needs to match the private IP addresses (for different limits etc. for example), one possibility is to do this on the LAN interface "out" direction. Another alternative is to use the newer "Advanced Queue" feature where "global" policy can be defined based on the private IP addresses for example."
By all accounts, my 'broken understanding' of how to build Advanced QoS rules might simply be an issue of NAT'ing.
Based on what he said, can I built bandwidth limits(HFQ) against the gateway address of a subnet instead of the whole range? Building rules against 10.10.10.0/24 isn't working, but what if I built the rules against 10.10.10.10(the gateway in this example).
Would this catch the bandwidth for everything in 10.10.10.0/24?
Is this one way around the NAT'ing caused by selecting a private IP range instead of a single host?