Is eth1 your LAN interface or your Internet-bound interface?
If you want to throttle clients' downloads on your LAN you want to shape on the LAN interface. If you want to throttle clients' uploads, use ISP-side interface.
While you can police an interface (ingress) it is not as robust as shaping (egress).
While you can use fwmark it may not be necessary for you.
See if you have better results in limiting when calling the IP from tc and go from there.
Code:
tc qdisc add dev eth1 root handle 1: htb default 10
tc class add dev eth1 parent 1: classid 1:1 htb rate 2mbit quantum 3000 burst 15k
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 2mbit quantum 1500 burst 15k
tc class add dev eth1 parent 1:1 classid 1:20 htb rate 200kbit ceil 200kbit quantum 1500 burst 15k
tc class add dev eth1 parent 1:1 classid 1:30 htb rate 100kbit ceil 100kbit quantum 1500 burst 15k
tc class add dev eth1 parent 1:1 classid 1:40 htb rate 32kbit ceil 64kbit quantum 1500 burst 15k
tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev eth1 parent 1:30 handle 30: sfq perturb 10
tc qdisc add dev eth1 parent 1:40 handle 40: sfq perturb 10
# 1:20 200kbit with 200kbit ceil
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.74/32 flowid 1:20
# 1:30 100kbit with 100kbit ceil
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.101/32 flowid 1:30
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.102/32 flowid 1:30
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.103/32 flowid 1:30
# 1:40 gets 32kbit with 64kbit ceil
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.104/32 flowid 1:40
# anything not explicitly defined gets 1:10
# 1:10 2mbit
I think I have that right...