Here is a sample config, I have used in the past, worked for me.
class-map match-any 250-kbit
match access-group name NETWORK-10
class-map match-any 512-kbit
match access-group name NETWORK-20
class-map match-any 1-Mbit
match access-group name NETWORK-30
!
!
policy-map RIZ-POLICY
class 250-kbit
police cir 250000
conform-action transmit
exceed-action drop
class 512-kbit
police cir 500000
conform-action transmit
exceed-action drop
class 1-Mbit
police cir 1000000
conform-action transmit
exceed-action drop
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
speed 100
full-duplex
!
interface FastEthernet0/1
ip address 10.10.10.2 255.255.255.252
ip nat inside
speed 100
full-duplex
service-policy input RIZ-POLICY
service-policy output RIZ-POLICY
!
ip nat inside source list NAT interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route 10.0.0.0 255.0.0.0 10.10.10.1
!
no ip http server
no ip http secure-server
!
ip access-list extended NAT
permit ip 10.0.10.0 0.0.0.255 any
permit ip 10.0.20.0 0.0.0.255 any
permit ip 10.0.30.0 0.0.0.255 any
ip access-list extended NETWORK-10
permit ip 10.0.10.0 0.0.0.255 any
permit ip any 10.0.10.0 0.0.0.255
ip access-list extended NETWORK-20
permit ip 10.0.20.0 0.0.0.255 any
permit ip any 10.0.20.0 0.0.0.255
ip access-list extended NETWORK-30
permit ip 10.0.30.0 0.0.0.255 any
permit ip any 10.0.30.0 0.0.0.255