....summary:
 it looks like the problem was caused by bridge handing over packets to
iptables firewall, so it was enough to add:
 iptables -I FORWARD -i br101 -d 255.255.255.255 -j ACCEPT
(br101 is the bridge on which I joined physical device with veth101.0)
such behaviour is caused by CONFIG_BRIDGE_NETFILTER=y in kernel config.

 Many thanks for much patience and help in resolving this annoying issue.

 regards, eyck
-- 
Key fingerprint = 40D0 9FFB 9939 7320 8294  05E0 BCC7 02C4 75CC 50D9
 Total Existance Failure