if the vpn terminates on the routers... fq_codel now (I cannot remember the kernel version, sorry) can preserve the inner hash of the vpn traffic and manage the flows before they hit the tunnel. This is mostly an ipsec, not openvpn, sort of thing.