OK, I tried push option...
First of all, after playing with settings for a while, I can connect now, as I've seen it.
But, even I restore settings, I still have to play with VPN&FW settings, as I don't know why it doesn't connect.
Then, after half hour or two days, connection returns??? With same settings!!!
OK, after connection is possible, I added push option as advised.
That means, OpenVPN goes to inactive state. To get it active...playing goes on.. and on.. and on... Most often, after changing encryption to AES-256-GCM 256 I have to turn "Certificate files from device" on/off and save. After doing this for 4..27 times, (it depends on stars on the sky...??) , VPN turns back to active state, and I am able to test it.
As You guessed, I can't establish connection to my ...106 device.
Port forwarding are from "any", 0-20000, to ..106.
X11 itself is reachable, so I can go in to the X11 settings via 192.168.1.1.
Whatever I'll do for the settings, result is that VPN turns to inactive mode, then the play starts from the beginning....
As I mentioned, even restoring settings from the backup, I can't connect, without playing with the VPN "saving".
This takes years to find out, what I'm missing, as even working connection might disappear when touching to some other settings. To me this looks like I have to be able to set all the right settings at once, then I might be lucky.
Do I have to make factory reset between any change, is a bit unclear so far, as I haven't got time to play with this that much.
(Now I know I can't create certificates one by one, otherwise X11 will get stucked, and factory reset is the only way to get forward...)
That's why I asked for each setting for both X11 & Android - so that I can put them correctly at once.