via iptables and tc, although I haven't done it myself.