I found it.
It was nfqws-keenetic module on router (keenetic hopper se).
All our routers with such filtering by default, but probably this one is buggy…
I think it just was breaking tcp tunnel with it’s fake packets.
Well, nfqws now is r.i.p and we keep on living with that knowladge.))
Thank you very much for your help and support.