Mix

loc             $FW            ACCEPT

loc              all               REJECT

# Policies for traffic originating from the firewall ($FW)

$FW             net             ACCEPT

$FW             loc              ACCEPT

$FW             all               REJECT

# Policies for traffic originating from the Internet zone (net)

net             $FW             DROP

net             loc                 DROP

net             all                 DROP

# THE FOLLOWING POLICY MUST BE LAST

all              all                REJECT

                                                                ---------------OR-----------------------------

# Policies for traffic originating from the local LAN (loc)

#

# If you want to force clients to access the Internet via a proxy server

# on your firewall, change the loc to net policy to REJECT info.

loc             net             ACCEPT

loc               $FW                    REJECT          info

loc                 all                      REJECT          info

#

# Policies for traffic originating from the firewall ($FW)

#

# If you want open access to the Internet from your firewall, change the

# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.

# This may be useful if you run a proxy server on the firewall.

$FW             net             REJECT          info

$FW             loc             REJECT          info

$FW             all             REJECT          info

#

# Policies for traffic originating from the Internet zone (net)

#

net             $FW             DROP            info

net             loc             DROP            info

-------------------------------------------------------------------------------------------

# vi /etc/shorewall/shorewall.conf 

STARTUP_ENABLED=Yes

-------------------------------------------------------------------------------------------

# vi /etc/shorewall/zones

fw        firewall

net       ipv4

loc         ipv4

-------------------------------------------------------------------------------------------

# vi /etc/shorewall/interfaces

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

#EXAMPLE-PC-BLOCK-ALL-SERVICE

~00-24-81-15-96-2F

#Shahin CAD

~C8-1F-66-42-A0-A2   tcp     80,8080,3128,443

#Polash CAD

~D4-3D-7E-56-9A-5E   tcp     80,8080,3128,443

##EXAMPLE-PC-BLOCK-FOR-INTERNET

192.168.1.1    tcp     80,8080,3128

192.168.20.134 tcp     80,8080,3128

--------------------------------------------------------------------

Check open port 

#netstat -nat

#netstat -nat | sort