Comment by somat

I run an openbsd firewall and was able to setup queues to limit connection speed. I mainly use it to banish iot devices to the shadow realm. (connectivity detection appears to work but it is slow enough that nothing really gets done)

If not on obsd the logic is usually the same, just read up on how your router implements fair service queues.

    queue base0 on em0 bandwidth 100M max 100M 
    queue full parent base0 flows 128 bandwidth 100M qlimit 128 default
    queue limited  parent base0 flows 128 bandwidth 1K max 1K qlimit 128
    
    match in on em1 queue limited

Another fun shadow realm technique is to see how much packet loss the device can tolerate with a rule like

    block in on em1 probability 20%

But this tends to trip the connectivity detector.