It looks like if in the FW rules you use
1: the host ip as a dst, and in the custom iptables parameters, use “-m limit –limit X/s –limit-burst X”, and choose ACCEPT,
2: then create a second FW rule under the first of the host ip as dst, and just a basic DROP….
This will accept only the stated pps to the host as a download, or flip-flop it for the upload.