Make sure you use Adaptive QoS. Traditional QoS disables NAT acceleration, which will limit you to around 400 Mbps on an RT-AC68P, more or less based on the complexity of your rule or any other feature you might have enabled at the firewall level and which requires CPU processing.