You describe your firewall/gateway requirements using entries in a set of configuration files Shorewall reads those configuration files and with the help of the iptables utility  Shorewall configures Netfilter to match your requirements