Ok.
I’ve spent a little bit time to check what iptables-rules are missing.
Then I’ve created shell script for custom iptables rules (configured in Luci), and it works (only after applying after vpn start).
ifconfig | grep tun | while read if x; do
iptables -t nat -A PREROUTING -i ${if} -m comment --comment "!fw3" -j zone_vpn_prerouting
iptables -t nat -A POSTROUTING -o ${if} -m comment --comment "!fw3" -j zone_vpn_postrouting
iptables -A INPUT -i ${if} -m comment --comment "!fw3" -j zone_vpn_input
iptables -I FORWARD 6 -i ${if} -m comment --comment "!fw3" -j zone_vpn_forward
iptables -A OUTPUT -o ${if} -m comment --comment "!fw3" -j zone_vpn_output
done
iptables -A zone_vpn_src_REJECT -m comment --comment "!fw3" -j reject
iptables -A zone_vpn_dest_REJECT -m comment --comment "!fw3" -j reject
iptables -A zone_vpn_dest_ACCEPT -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
iptables -A zone_vpn_dest_ACCEPT -m comment --comment "!fw3" -j ACCEPT
iptables -A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_REJECT
iptables -A zone_vpn_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_vpn_rule
iptables -A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT