Find the active NAT rule

I have an ipsec tunnel that doesn’t work as the device makes a NAT on the packets.
I can see the next in the log

11:42:56 firewall,info sync: kabel_pass output: in:(none) out:ether7_IPSEC, proto UDP, xxx.xxx.180.187:500->xxx.xxx.191.10:500, NAT (xxx.xxx.180.187:500->xxx.xxx.180.186:500)->xxx.xxx.191.10:500, len 156

I would like to find out why is the source NAT-ed.
Is there a way to find out which rule makes the translation ?

Can it be manipulated in the prerouting phase with mangle ?

It’s the first masq rule. Just create accepting rules above with source and destination networks of you LANs.

Thanks.
It is clear now