Thank you for your input.
It is - finally - working as intended. There was a setting in the VPN client to AirVPN I had overlooked, namely a button allowing (respectively denying) incoming traffic. Once this was set and it was ensured that all Internet traffic is being tunneled through the connection to AirVPN's tunnel, I was able to establish a connection to the server on the Asus router.
I still cannot reach the router's GUI, although I made it available to more than just the internal (LAN) interface. I assume by clicking the respective button, the GUI only becomes available to the WAN interface but not the VPN connection. That's fine though, I do not need - nor want - the GUI to be reachable from outside anyways.
With regards to the last post with the easier solution: You are right that it would be easier to connect directly to a service/machine behind the router if I wanted to access that service only. However, I want to do more than that in my LAN, e.g. sending WOL magic packets waking up machines in the LAN and accessing a storage unit that is not running always.