Also I've figured out that if I create an upper rule like 'Permit / UDP / Source IP: client IP / Source Port: Any / Destination IP: Any / Destination Port: Any", everything works.
So it is a bug that the rule mechanism does not take matter of destination IP address and port + Protocol, only Protocol (in case of UDP)
I've got an old deprecated model ZyXel / Keenetic Lite III with the same rule set, and it does not have this bug.
Can I contact the vendor support to fix this bug?