OpenVPN Bride - Routing or Firewalling missed?

Hello,

I have following two site setup. Configuration was done based on some UBNT guides.

== Site A ==

16M DSL Connection, Fritz!Box as Modem/Router

ER-PoE (eth2) connected to LAN on Fritz!Box, Device on eth1 should be to a "vitual L2 network" with a device on the other site

OpenVPN Server on ER-PoE with TAP/bridge Mode

internal LAN 192.168.0.0/24

OpenVPN LAN 192.168.1.0/24, 192.168.1.1 to ER-PoE ans 192.168.1.100 and following to OpenVPN Clients

== Site B ==

20M Cable Connection, Fritz!Box as Modem/Router

ER-X (eth0) connected to LAN on Fritz!Box

OpenVPN as Client on ER-X

internal LAN 192.168.2.0/24

ER-X is connected as OpenVPN Client to Server on ER-PoE. Connection is good and active for 2 days. ER-X get 192.168.1.100 from Server. But I cannot pass traffic over the OpenVPN connection. Pinging from ER-PoE to 192.168.1.100 fails and ping from ER-X to 192.168.1.1 fails also.

Do I have to setup any additional route or firewall rule?

ER-PoE config:

firewall {
    all-ping enable
    broadcast-ping disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    bridge br0 {
        address 192.168.1.1/24
        aging 300
        bridged-conntrack disable
        hello-time 2
        max-age 20
        priority 0
        promiscuous disable
        stp false
    }
    ethernet eth0 {
        address dhcp
        description unused
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
        poe {
            output off
        }
        speed auto
    }
    ethernet eth1 {
        bridge-group {
            bridge br0
        }
        description VPN
        duplex auto
        speed auto
    }
    ethernet eth2 {
        description "Local 2"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth3 {
        description "Local 2"
        duplex auto
        poe {
            output 24v
        }
        speed auto
    }
    ethernet eth4 {
        description "Local 2"
        duplex auto
        poe {
            output 24v
        }
        speed auto
    }
    loopback lo {
    }
    openvpn vtun0 {
        bridge-group {
            bridge br0
        }
        device-type tap
        encryption aes256
        mode server
        openvpn-option "--user nobody --group nogroup"
        openvpn-option "--proto udp"
        openvpn-option "--port 1194"
        openvpn-option --persist-key
        openvpn-option --persist-tun
        openvpn-option "--keepalive 10 90"
        openvpn-option --comp-lzo
        openvpn-option "--verb 1"
        openvpn-option "--server-bridge 192.168.1.1 255.255.255.0 192.168.1.100 192.168.1.150"
        openvpn-option "--push redirect-gateway def1 bypass-dhcp"
        openvpn-option "--push dhcp-option DNS 192.168.1.1"
        openvpn-option --client-to-client
        server {
            subnet 192.168.1.0/24
        }
        tls {
            ca-cert-file /config/auth/cacert.pem
            cert-file /config/auth/server.pem
            dh-file /config/auth/dhp.pem
            key-file /config/auth/server.key
        }
    }
    switch switch0 {
        address 192.168.0.3/24
        description "Local 2"
        mtu 1500
        switch-port {
            interface eth2 {
            }
            interface eth3 {
            }
            interface eth4 {
            }
            vlan-aware disable
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface switch0
    lan-interface eth1
    lan-interface br0
    lan-interface vtun0
    wan-interface eth0
}
protocols {
    static {
    }
}
service {
    dns {
        forwarding {
            cache-size 150
            listen-on switch0
            listen-on vtun0
            name-server 8.8.8.8
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    ssh {
        port 22
        protocol-version v2
    }
}
system {
    gateway-address 192.168.0.1
    host-name ER-PoE
    login {
        user ubnt {
            authentication {
                encrypted-password xxx
            }
            level admin
        }
    }
    name-server 192.168.0.1
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/Amsterdam
}