Hmm, dunno. In my asterisk setup, I got to cheat since the QoS stuff in iptables only supports ToS, but the DSCP stuff ends up in the upper 6 bits of the IP ToS field, so I figured out the two values and did that. Dunno why the GS does this.