Okay, I failed with OpenVPN. Did not get it running. Tried tinc then. Well... After noticing that systemd is just lying about tinc is running (it was not! The process just died due to errors and was not running), I was able to setup the mesh VPN between three nodes, one behind the router. systemd made me very angry again for not beeing able to start tinc. It's only working when I start it on console. Systemd is just lying everything is okay, it's not.
However there is still the problem, that tinc does not propagate any of the other site subnets to the mesh members. It apears that I need to setup the routing on my own. The examples I read only told to route the subnets via the tinc interface, but this does not seem to be enough. I need to figure out how to setup this properly.
And I need to figure out why systemd does not start tinc, but tells me it's running. Switching to initd is sadly not an option, I can't do this on the host systems.