/etc/shorewall/masq
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
eth0 192.168.35.0/16,\
172.16.35.0/12,\
172.16.1.0/12
/etc/shorewall/interfaces
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect tcpflags,dhcp,nosmurfs,routefilter,logmartians
loc eth1 detect tcpflags,nosmurfs,routefilter,logmartians
dmz eth2 detect tcpflags,nosmurfs,routefilter,logmartians
vpn tap0 detect tcpflags,nosmurfs,routefilter,logmartians
/etc/shorewall/zones
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
loc ipv4
dmz ipv4
vpn ipv4
/etc/shorewall/polic
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
loc all REJECT
$FW all ACCEPT
vpn all ACCEPT
net all DROP info
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT infoy