I have searched many answers over the internet, no one works,like
http://woshub.com/l2tp-ipsec-vpn-server-behind/
The reason Why only one l2tp windows client behind unique public IP can connect to the dedicated server is windows use source specific udp port 1701 to connect l2tp server, not like andriod,linux , so the tuple (sip,sport ,dip,port)->(xx.xx.xx.xx,1701,xx.xx.xx.xx,1701) can't distinguish two clients.
my resolve is simple , let windows use random source udp port to connect server, but I did not find the way to do this. any other plans can help