On Mon, Aug 2, 2010 at 3:46 PM, Franchoze Eric [off-list ref] wrote:

quoted

Do the QoS on your next hop router

There is no next router. And QoS should be on the same machine.

quoted

or on the interface all your de-encapsulated VPN traffic flows over (ie. 'eth0') instead.

It is not a problem to find interface with de-encapsulated traffic. The problem is that tc rules should be written accoring to network device.

try ifb:

config IFB
        tristate "Intermediate Functional Block support"
        depends on NET_CLS_ACT
        ---help---
          This is an intermediate driver that allows sharing of
          resources.
          To compile this driver as a module, choose M here: the module
          will be called ifb.  If you want to use more than one ifb
          device at a time, you need to compile this driver as a module.
          Instead of 'ifb', the devices will then be called 'ifb0',
          'ifb1' etc.
          Look at the iproute2 documentation directory for usage etc

-- 
Regards,
Changli Gao(xiaosuo@gmail.com)