@ZdenekM 

There is no need of static route so this can you remove?

I think you have to look at firewall rule on server running controller. 

add a rule that give 192.168.3.0/24 access to server.

/shberge

@shberge Thanks for the reply! I wasn't sure about the static route, but it is now removed. I added the rule on the server (iptables -A INPUT -s 192.168.3.0/24 -j ACCEPT) but nothing has changed.

With the new controller version (5.1.7) it is possible to set the VPN IP pool the same as my standard pool, which is 192.168.1.1/24 - so I have done it in hope that I will be able to connect to my home server (where the controller is running) from outside. But it didn't help. I don't think it is a matter of firewall rules on the server - before buying TP-Link stuff, with exactly the same settings, I used to have a VPN server on that machine, and the connection from outside worked without any problem. So I'm suspecting that there is something wrong with the controller or router. I can't even ping the server when connected through the VPN but I can connect to any other machine in the network. Just not the one that is the most important :-)