There's an issue with the Shorewall package in Debian 9 Stretch, causing Shorewall not to automatically start even when the required configuration files are in-place and/or modified. As stated here, the problem also exists on Ubuntu with some versions of the package (see article).

The problem lies with the package not enabling the startup script in systemd during installation. The solution is to manually enable this by running the following command (as sudo):

systemctl enable shorewall.service

This will enable Shorewall to automatically start during a reboot. Note that you will still have to set the correct parameters in /etc/default/shorewall (and possibly /etc/shorewall/shorewall.conf t  ...