In the current case, there is still a Fritzbox in bridge mode in front of the controller, and it has a different public IP address than the controller. With the current options, it does not seem possible to create a VPN tunnel.