The web shield doesn't 'create' any connections, it acts as a localhost proxy (so that it can scan files before they are saved to your browsers cache). So when you use your browser to connect to a web site, that call is redirected through the web shield proxy, so the connection is initiated by you and your browser. The firewall reports the traffic through the proxy.