I had a slew of these entries in the system log. When I say "slew" I mean in excess of 200
2015-10-03, 05:23:31 ALLOW UDP xx.xxx.xx.x:500 -> xx.xxx.xxx.xxx:500 on eth1
They continued until I power cycled my DSL modem, then I got this entry and the aforementioned entries stopped:
2015-10-03, 05:24:15 VPN Log [grpips1]: [Tunnel Disconnected]
2015-10-03, 05:24:15 VPN Log [grpips0]: [Tunnel Disconnected]
Was this some kind of attack?