/etc/shorewall/interfaces 

###############################################################################
#ZONE	INTERFACE	BROADCAST	OPTIONS
net     eth0            detect          logmartians,routefilter,nosmurfs
lan	eth1		detect		dhcp,logmartians,routefilter,nosmurfs

/etc/shorewall/params 

WAN_IP=x.x.x.x
RFC1918="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

/etc/shorewall/zones 

###############################################################################
#ZONE	TYPE	OPTIONS			IN			OUT
#					OPTIONS			OPTIONS
fw	firewall
vpn	ipv4
net     ipv4
lan	ipv4

/etc/shorewall/policy 


###############################################################################
#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
$FW		all		ACCEPT
vpn		lan		ACCEPT
lan             vpn             ACCEPT
net		all		DROP		info
all		all		DROP		info

/etc/shorewall/rules 

#############################################################################################################
#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK
#                                                       PORT    PORT(S)         DEST            LIMIT           GROUP
DROP:info	net:${RFC1918}	all

# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
ACCEPT         all      $FW:${WAN_IP}     icmp    0       -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    3       -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    4       -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    11      -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    12      -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    30      -       -       30/sec
ACCEPT         all      $FW:${WAN_IP}     icmp    8       -       -       3/sec
ACCEPT         all      $FW:${WAN_IP}     udp     33434:33523     32769:65535     -       3/sec

##
# ACCEPT
##
ACCEPT          net:${MYNETWORK}        $FW:${WAN_IP}        tcp     22,80,443
...

/etc/shorewall/tunnels 

#TYPE         ZONE        GATEWAY             GATEWAY ZONE
ipsec         net         <ipsec-end-point-on-other-side>