Advanced Queue - can't get it working

Hi,

I want to replace my traffic shapers by the use of advanced queues ... but hence the lack of a really good fundamental documentation I can't get it working properly. I even fail with the basics Image may be NSFW.
Clik here to view.

My core network is connected to eth0, and my very first simple attempt should limit the download traffic to my test computer (10.0.1.1) to 5 MBit/s. So I did this:

traffic-control {
    advanced-queue {
        branch {
            queue 110 {
                bandwidth 1000mbit
                description "Server Traffic"
                parent 1
                priority 4
            }
        }
        filters {
            match 111 {
                attach-to 110
                description Win2012
                ip {
                    destination {
                        address 10.0.1.1/32
                    }
                    source {
                    }
                }
                target 111
            }
        }
        leaf {
            queue 111 {
                bandwidth 2mbit
                ceiling 5mbit
                description Win2012
                parent 110
                queue-type FQ_COD1
            }
        }
        queue-type {
            fq-codel FQ_COD1 {
                ecn enable
            }
        }
        root {
            queue 1 {
                attach-to eth0
                bandwidth 1000mbit
                description "PPPOE Down"
            }
        }
    }
}

So from the readings here, the leaf 111 should guarantee 2MBit/s but never exceed 5MBit/s, and match111 should match do all traffic which goes out to 10.0.1.1

But all is acting as the whole stuff would not exist ... do I need to "enable" the advanced queue thing by a global switch somewhere? Or what am I doing wrong?

Once this is running, I've got a second thought:

The very best thing to use the QOS is on my pppoe0 interface, which is the WAN. But: I guess at this point I can't have a match on internal IP addresses, as this is before NAT - is this correct? If yes, how can I apply rules only to traffic which really leaves via WAN ... and not limiting traffic which the router processes internally via my VLAN's?