/etc/shorewall/masq
#INTERFACE              SOURCE          ADDRESS         PROTO   PORT(S) IPSEC   MARK
eth0                    192.168.35.0/16,\
                        172.16.35.0/12,\
                        172.16.1.0/12

/etc/shorewall/interfaces
#ZONE   INTERFACE       BROADCAST       OPTIONS
net     eth0            detect          tcpflags,dhcp,nosmurfs,routefilter,logmartians
loc     eth1            detect          tcpflags,nosmurfs,routefilter,logmartians
dmz     eth2            detect          tcpflags,nosmurfs,routefilter,logmartians
vpn     tap0            detect          tcpflags,nosmurfs,routefilter,logmartians

/etc/shorewall/zones
#ZONE   TYPE    OPTIONS                 IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4
dmz     ipv4
vpn     ipv4

/etc/shorewall/polic
#SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST
loc             all             REJECT
$FW             all             ACCEPT
vpn             all             ACCEPT
net             all             DROP            info
# THE FOLLOWING POLICY MUST BE LAST
all             all             REJECT          infoy