Allow me to think along with you. You have three routing devices in series, which means that any traffic to the second IPFire instance has been NAT’ed twice already.
In order for any device to be able to connect to the double NAT’ed firewall, you need to configure DNAT (destination NAT; aka port forwarding) for the used UDP and TCP port on both the Fritzbox and the first firewall.
That way the traffic for OpenVPN terminating on your uplink (the Fritzbox) is forwarded down the line to the first firewall, which forwards it to the second one. The second one can establish the connection and return traffic is NAT’ed accordingly upstream.
Please correct me if I’m wrong