I don't like to give up quickly :) I have one potential idea on how to get around this. The OPNSense instance is located on a Proxmox virtual machine and the traffic goes through two software bridge OVS (vmbr1 - external (Internet), vmbr2 - internal (internal network)), will it work to move the traffic shaping functionality to OVS before the traffic reaches OPNSense? Does it make sense?