Sorry, that was not very smart question from my side.
I figured it out what I did wrong. Packets did not get lost
I was SYNC flooding on LAN interface, not WAN, so all IPs from outside network were just rejected when it came to routing decision. All clear, case closed
Regards,