Traffic Shaping Appliance

I am looking to build a linux box to shape traffic for large number of users. I want to place the box in my network and pass all traffic through it on the way to the existing NAT firewall. How to you forward packets through the box from one interface and out the other so you can shape as obviously they will be on the same network as the box will only do shaping. You can't put both the incoming and outgoing interfaces into a bridge as once they are in a bridge you are unable to create virtual interfaces on the ports for shaping if they are assigned to a bridge and adding virtual interfaces to the bridge along with the shaping rules won't shape. Any help would be appreciated.