I found part of my error- keepin the VPN in the Fritzbox enabled of course blocks the ports I wanted to forward- stupid me.
Now I forwarded udp Port 500 and 4500 to the core and I can see something happening in tcpdump
tailing /var/log/auth.log finally throws this one:
Feb 25 13:06:53 dcerouter pluto[2714]: ERROR: asynchronous network error report on eth0 (sport=4500) for message to 109.41.128.19 port 32732, complainant 109.41.128.19: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
does anyone has a suggestion for me?