У себя я нашёл причину сабжа. В своих конфигах запускал dnsmasq от пользователя nobody и указывал лог в /dev/null.
dnsmasq при этом прилежно менял права на лог файл при старте, искренне считая его своим.
Порядок. Во всех смыслах.
root@Keenetic_Omni:~# cat script.log
/opt/etc/ndm/netfilter.d/001.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/002.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/003.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/004.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/005.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/001.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/002.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/003.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/004.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/005.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/001.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/002.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/003.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/004.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/005.sh executed at Mon Aug 1 06:01:38 UTC 2016
/opt/etc/ndm/netfilter.d/001.sh executed at Mon Aug 1 06:01:40 UTC 2016
/opt/etc/ndm/netfilter.d/002.sh executed at Mon Aug 1 06:01:40 UTC 2016
/opt/etc/ndm/netfilter.d/003.sh executed at Mon Aug 1 06:01:40 UTC 2016
/opt/etc/ndm/netfilter.d/004.sh executed at Mon Aug 1 06:01:40 UTC 2016
/opt/etc/ndm/netfilter.d/005.sh executed at Mon Aug 1 06:01:40 UTC 2016
/opt/etc/ndm/netfilter.d/001.sh executed at Mon Aug 1 06:01:41 UTC 2016
/opt/etc/ndm/netfilter.d/002.sh executed at Mon Aug 1 06:01:41 UTC 2016
/opt/etc/ndm/netfilter.d/003.sh executed at Mon Aug 1 06:01:41 UTC 2016
/opt/etc/ndm/netfilter.d/004.sh executed at Mon Aug 1 06:01:41 UTC 2016
/opt/etc/ndm/netfilter.d/005.sh executed at Mon Aug 1 06:01:41 UTC 2016
Спасибо за работу.
ЗЫ: судя по логу, после перезагрузки скрипты netfilter.d дёргались пять раз несмотря на IPoE-подключение. Так и должно быть?