Question Router, VPN and telephone solution for my home

[RejRejiyNT]

Hello experts,
I have recently purchased nordVPN to secure my most important PC's and mobile phones at home.
Now I'm looking for a solution for my whole household, buying a VPN capable router to protect all of my connected devices form cyber threats and ISP spying.
Please note that I am not from the US or Europe and my current router/modem is Technicolor tg789vac v2 with gigabit optic fiber infrastructure recently installed on our block.

after some digging I found that Asus routers are preferred for people who are not into networking too much as you don't need to flash a custom firmware on them to use VPN efficiently and securely, and that upgrading it for free to AsusWRPMerlin provides even more security and features.
I was pretty close to buying the Asus RT-AC66U B1 until I called my cousin (who works in the field here) to check if it gonna be enough for our house needs, as we have 3 PC's on LAN and 3 PC's, 6 phones and a single PS4 on WiFi (we plan on adding 2 TV streamers to the WiFi to cut the monthly cost of cable).
He said it's gonna be alright as there only rare instances where all of these devices game or stream HD video simultaneously
(hypothetical peak internet use on weekends after the TV streamers are set-up gonna be: 3 LAN PCs game and watch HD youtube/2LAN PCs+PS4, 2 TVs stream HD video, 2 WiFi PCs inuse/watch HD video) this gonna happen once per month tops.

Next he asked me about the current set-up (what he called "topology") and if im sure I wanna order from newEgg and not buy locally so I'd have more support and less risk of the package being stopped by customs (Ministry of Communication is tight on letting people order anything related to networking if the item wasn't approved by the local Standards Institute) after I explained to him that I've seen similar products sold locally for much higher price (they are approved by the Ministery of Communication/standards institute) and that some friends have ordered from newEgg and received the package to their doorstep by FedEx with no problems with customs at all.
We saw the deal breaker, the reason I come here before you humble people of tom'sHardware and write my life's auto biography in this wall of a forum thread
a telephony port on my Technicolor tg789vac v2 is connected and in-use for our home phone number.

I called my ISP immediately to get answers.
they said that my parents set up the telephone over the Internet and if I want to replace the ISP provided TG789 modem/router with another one it has to have the same kind of phone port and I'd have to set it up manually or our home telephone wont work.
our set up at home is as follows:
Optic fiber from wall -> D-link G01LC Media converter-> ethernet cable -> WAN port of the TG789vac v2 -> 4 LAN port (PCs and cable VOD thingy) AND at the leftmost side (the manual calls it just "phone port") single cable going back into a port in the wall labeled "VDSL".
I thought i can use a VPN router for all the LAN and WiFi devices, connect it to the TG789 which would be connected in the same topology as before (wifi disabled) to connect everything to the internet and keep the phone cable still in the TG789.
But the ISP tech support guy said that its not possible and i have to get a router with a telephone port. And as I'm writing this I also think that that's probably a very poor implementation security and performance-wise.

In a perfect world I want to be able to use the gigabit fiber internet connected to our flat to its full extent with as little hardware bottleneck as possible, be able to get a stable connection on all the devices mentioned above and everything being protected by nordVPN which is set-up on the router connecting everything to the Internet.

I know Its a lot of reading and a bit much to take in so a huge "thank you" in advance to anyone who reads this and can help me out!

 

[failboat]

I would recommend a 24/7 small server for this.

See what throughput you get on your fastest computer. These low watt routers are 100 times slower.

Your router can route packets to a client with some static routes.

 

[bill001g]

In general you can not replace modem/router that have phone ports in them. The ISP needs to have special setting to ensure the voice works. So I would just try to ignore it and plug the new router into the ISP router. You want to turn the wifi radios off. There are some issues with running router behind router related to game consoles but will ignore that for now.

Normally I don't make specific router recommendation but with VPN you have to worry about cpu speeds. Many routers will cap out at about 20-30mbps because of the cpu. The only way to truly get past this is to use something like a PC that has a real cpu to encode all the vpn data. The router I have seen with the highest VPN speeds is a asus rt-ac86u. You want to run merlin firmware on this device also. It can get in the 200mbps range because it has a encryption acceleration feature. You have to be somewhat careful to choose the chipher it uses not all are accelerated. I think the one you use on nord is aes-256-gcm. You need to check this though.

Otherwise you need to use a small pc to get speeds you will need.

 

[RejRejiyNT]

I dont have the money for a 24/7 small server haha
nor the time or technical skill for such setup
how do I check throughput and why does it matter?

Your router can route packets to a client with some static routes.

I dont understand at all what you mean by this...

I am looking for a solution costing about 180 USD inc. VAT and shipping to my country, not to dedicate a room to networking..
VPN router and some way to still connect the telephone line we have here, our ISP provides telephone over the internet and thats the problem im facing in trying to buy and setup a vpn router to protect my whole home.

 

[RejRejiyNT]

In general you can not replace modem/router that have phone ports in them. The ISP needs to have special setting to ensure the voice works. So I would just try to ignore it and plug the new router into the ISP router. You want to turn the wifi radios off. There are some issues with running router behind router related to game consoles but will ignore that for now.

Normally I don't make specific router recommendation but with VPN you have to worry about cpu speeds. Many routers will cap out at about 20-30mbps because of the cpu. The only way to truly get past this is to use something like a PC that has a real cpu to encode all the vpn data. The router I have seen with the highest VPN speeds is a asus rt-ac86u. You want to run merlin firmware on this device also. It can get in the 200mbps range because it has a encryption acceleration feature. You have to be somewhat careful to choose the chipher it uses not all are accelerated. I think the one you use on nord is aes-256-gcm. You need to check this though.

Otherwise you need to use a small pc to get speeds you will need.

thank you for the great and detailed answer!
I guess ill have to live with the draw backs of running a router behind router because it seems that's my only option..
can you say what are exactly the issues to be expecting on the PS4 with such a set up?
higher ping? or some other problems?
just so i wont get surprised or anything

 

[bill001g]

Not sure about ps4 but console in general have issues with NAT. You now have 2 NAT devices in the path. You can fix it with port forwarding or dmz options it is just a pain to have to do 2 routers. If the game console is going via vpn you are going to have that same issue since the ip is shared.

 

[RejRejiyNT]

Not sure about ps4 but console in general have issues with NAT. You now have 2 NAT devices in the path. You can fix it with port forwarding or dmz options it is just a pain to have to do 2 routers. If the game console is going via vpn you are going to have that same issue since the ip is shared.

i guess by port forwarding you mean to port forward on the second router to ports for PS4?
and whats a DMZ?
can you explain a bit, i already ordered the ASUS AC86U and i want to ready with all the guides and stuff to install it

will i need special cabales? or just connecting a LAN port to the WAN port of the ASUS gonna be enough?

 

[bill001g]

Like the simplest option is to use the DMZ option on the ISP router and point it to the new asus. In the asus you will need to configure the VPN to have all the PS4 traffic bypass the vpn. You then port forward as normal and the UPnP "should" work. UPnP is messy even without 2 routers and vpn.

If you are going to run the ps4 over the vpn connection then you are just going to have to live the strict nat issue. You are sharing the ip address with other people at the vpn and can not set port forwarding rules.

Make sure you load the merlin firmware on that router. Last time I checked it still had a slight performance gain over the stock firmware.....then again asus has been incorporating a lot of merlin's code into the base.

 

[RejRejiyNT]

Like the simplest option is to use the DMZ option on the ISP router and point it to the new asus. In the asus you will need to configure the VPN to have all the PS4 traffic bypass the vpn. You then port forward as normal and the UPnP "should" work. UPnP is messy even without 2 routers and vpn.

If you are going to run the ps4 over the vpn connection then you are just going to have to live the strict nat issue. You are sharing the ip address with other people at the vpn and can not set port forwarding rules.

Make sure you load the merlin firmware on that router. Last time I checked it still had a slight performance gain over the stock firmware.....then again asus has been incorporating a lot of merlin's code into the base.

What is DMZ and how can i set it up?
What do you mean by saying UPnP is messy even without 2 routers?
Why do I need t port forward for the PS4? with my current router I didn't set up any ports and everything works just fine.
How will I need to set up the ports in this new topology in my house?
Sorry that im not very networking litarate but to my understanding traffic going from my ps4 console gonna follow this "topology" right?
PS4 traffic ---over WiFi--> ASUS AC86U ---encryption inside the router----> PS4 VPN protected traffic ----WAN port to LAN----> Technicolor TG789vac v2 ----WAN port---> D-link G01LC Media converter ---optic fiber---> Wall

and lastly what's that "strict nat issue" you mentioned and how it can affect my use of the PS4?

 

[bill001g]

Maybe just try it and when you have issue then you can fix this. Consoles run many games that do not have central servers. One of the machines must act as the host/server and that machine needs to accept incoming sessions. So rather than trying to explain why this needs a special config maybe you do not run games that will be affected.