Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
What might be done, depends much on the platform, which you didn't note.
However, in general, you can often easily guarantee outbound bandwidth. Ingress bandwidth, though, is often very difficult to impossible to manage with ordinary network devices. Special 3rd party traffic shaping devices can do a much better job managing ingress bandwidth, but even those are not 100%.
If you really want to guarantee or reserve bandwidth, for a tunnel across the Internet, it's best to obtain Internet links dedicated to only the tunnel traffic. "General" Internet traffic should be on another link.
Otherwise what might help, is policing (assuming 10 Mbps) non-tunnel ingress traffic to 5 Mbps (or less, sometimes much less). Such policing may keep non-tunnel traffic from consuming all the ingress bandwidth. (NB: one of the issues with ingress policing, it restricts ingress traffic's bandwidth all-the-time, even when it's otherwise available.)
Another option is shaping non-tunnel outbound TCP ACKs. It's rather inexact, but it can also regulate ingress TCP bandwidth consumption.
Again, unless you want to use a 3rd party traffic shaping appliance, you're best bet would likely be to obtain another Internet path for dedicated tunnel traffic.
