Nextcloud in DMZ - Limit for remote users, none for LAN

[sgw]

We have a nextcloud server in the DMZ (behind a NAT-Portforwarding) and want to limit external users to not fully use up the 16 MBit/s DSL line when they download hosted files.
Internal users in LAN should have full speed, sure.

We tried apache-bandwidth-control with nearly no success.

Now we consider solving this on pfsense.

QoS is already used for VOIP on LAN and WAN, I assume we could solve this by setting/using (a) limiter(s)?

As I haven't used these before I am searching for a good example or howto, got a bit lost browsing the many forum pages  … maybe someone has a good pointer?

EDIT (SOLVED?):

I think I got it.

Defined 2 Limiter-Queues along https://forum.pfsense.org/index.php?topic=114569.msg637004#msg637004
Then assigned them to the NAT-Rule on the WAN-interface.

First tests look good.
Is my solution correct?

[KOM]

Is my solution correct?

It's correct if it solves the problem without introducing any new problems.  Have a read of this as well:

https://www.reddit.com/r/PFSENSE/comments/3e67dk/flexible_vs_fixed_limiters_troubleshooting_with/

[sgw]

been there as well already  ;)  thanks