
у меня сработал кипэлив
Вот лог:
Jan 1 23:50:54 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=89.20.123.199 DST=92.112.38.104 LEN=52 TOS=0x00 PREC=0x00 TTL=46 ID=63316 DF PROTO=TCP SPT=2921 DPT=49333 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 23:59:44 daemon info pppd[241]: LCP terminated by peer
Jan 1 23:59:45 daemon info pppd[241]: Connect time 1439.0 minutes.
Jan 1 23:59:45 daemon info pppd[241]: Sent 3572991434 bytes, received 757591671 bytes.
Jan 1 23:59:46 daemon warn pppd[241]: Couldn't increase MRU to 1500
Jan 1 23:59:49 daemon notice pppd[241]: Connection terminated....
Jan 1 23:59:49 user warn syslog: dns query failed
Jan 1 23:59:51 user warn syslog: dns query failed
Jan 1 23:59:52 daemon info pppd[241]: Sent PADT
Jan 1 23:59:52 daemon info pppd[241]: PPP session is 6261
Jan 1 23:59:52 daemon info pppd[241]: Using interface ppp0_1_32_1
Jan 1 23:59:52 daemon notice pppd[241]: Connect: ppp_0_1_32_1 <--> nas_0_1_32
Jan 1 23:59:52 daemon warn pppd[241]: Couldn't increase MRU to 1500
Jan 1 23:59:52 daemon warn pppd[241]: Couldn't increase MRU to 1500
Jan 1 23:59:53 daemon notice pppd[241]: PAP authentication succeeded
Jan 1 23:59:53 daemon notice pppd[241]: peer from calling number 00:90:1A:42:B1:CA authorized
Jan 1 23:59:53 user warn syslog: dns query failed
Jan 1 23:59:53 daemon notice pppd[241]: local IP address 92.112.185.241
Jan 1 23:59:53 daemon notice pppd[241]: remote IP address 195.5.5.184
Jan 1 23:59:53 daemon notice pppd[241]: primary DNS address 195.5.46.12
Jan 1 23:59:53 daemon notice pppd[241]: secondary DNS address 195.5.46.10
Jan 1 23:59:55 user warn syslog: dns query failed
Jan 1 23:59:56 user debug syslog: route add default gw 195.5.5.184 2>/dev/null
Jan 1 23:59:57 user warn syslog: dns query failed
Jan 1 23:59:58 user debug syslog: iptables -A FORWARD -o ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 23:59:58 user debug syslog: iptables -A FORWARD -i ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 23:59:59 user debug syslog: iptables -t nat -D POSTROUTING -o ppp_0_1_32_1 -s 192.168.1.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Jan 1 23:59:59 user debug syslog: iptables -t nat -A POSTROUTING -o ppp_0_1_32_1 -s 192.168.1.0/255.255.255.0 -j MASQUERADE
Jan 2 00:00:10 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=85.249.13.12 DST=92.112.185.241 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=38033 DF PROTO=TCP SPT=3809 DPT=1523 WINDOW=65535 RES=0x00 SYN URGP=0
Ничего не трогал. Почему сработал - неизвестно. Посмотрим, сработает ли завтра. Если сработает - будет очень хорошо

Может это УТ что-то все же подкрутил. Хотя с чего бы это вдруг...