IPsec client behind MT nat

Hi,
my router has assigned static public ipv4. Firewall makes masquerade. In filter there isn’t any entries, in nat(only one, for masquerade) also. Upnp is enabled.
And I have got problem with ipsec client on computers behind nat. They can’t connect. When I use cheap Tp-Link router for 15USD all works.

How to configure to passthrough IPsex/L2TP traffic?