Thank you for tip, now this is working. PPTP was my attempt to simplify process and avoid possible other problems, the idea is to work with L2TP/IPSec, and behavior is same, if I disable another WAN and public IP WAN is default gateway everything is working OK. With output chain and few other detail...