Read the Shorewall documentation Openvpn section.

Define a new Shorewall Zone:

vpn	VPN	VPN

Define the VPN policy:

# if they're on the VPN, we can trust them -- can't we?
vpn	all	ACCEPT

Define the masquerading policy:

# we can't use the interface name here because Shorewall will choke if it's not up yet
eth0	10.0.0.0/24