For Kenneth : if you still want to use TOS, I would reset it to 0 in POSTROUTING chain, as some silly guys drop packets with non null TOS value.
What "silly guys" do that? Sounds rather anti-social. I can see ignoring the QoS request and dumping the packet in the default queue, but not dropping the packets.
Doesn't ssh set the Minimize-Delay value?
