On the external interface you apply rules for upload, an internal PC connecting to a machine on the internet. You can limit and also guarantee rates in this case.
On the internal interface you apply rules for download, when the traffic is coming back. There you can only limit the rate.