VPN on a Time Capsule using a second router.

Question

Ok, I fully realize that the Apple routers do not support VPN.  However, I read here that some guy from Melbourne said that I can buy a second router and place it behind the time capsule and send all VPN traffic through it.
"From what I can see most of these services recommend 3rd party cheap end stuff. Go with that. That means you keep the TC as the main router. Put the vpn router behind it and run all the equipment that needs vpn access to connect to the vpn router."
So, if this is correct, I'm wondering exactly how this is set up.  I use Time Warner's fiber and bought my own modem which does not have a router built in, and hence only has one Ethernet port which is where the time capsule is plugged in.  Im also using Hide My A$$ VPN service.  So, if I buy another router and plug it in behind the time capsule, this tells me that I would plug the new VPN  router into an Ethernet port on the time capsule.  Is this correct?  If so, then wouldn't the VPN router be nullified by the Time capsule?  I mean, when a service pings me, they will hit the time capsule before hitting the new VPN router, and hence see my true location wouldn't they?
I want to use the time capsule as my nat, and hence don't want to bridge it.  Is it possible to do what I want to do?
Thanks,
Jim

Answer 1

Hi.. maybe posts I have done.
I fully realize that the Apple routers do not support VPN.
It might be worse than that.. some firmware levels probably break even vpn passthrough.
I want to use the time capsule as my nat, and hence don't want to bridge it. 
Yes, but I would like to know why the TC as NAT is important to you... please realise that one particular feature, namely BTTM and ICloud maybe causing vpn to break.
I also do think it is easier to use a vpn router and bridge the TC behind it.
"From what I can see most of these services recommend 3rd party cheap end stuff. Go with that. That means you keep the TC as the main router. Put the vpn router behind it and run all the equipment that needs vpn access to connect to the vpn router."
Yes, there is no need for expensive routers.. many 3rd party firmware will do a good job with fairly cheap hardware. Do take advice from the service you use though.. eg StrongVPN service recommends and has lots of details for setting up dd-wrt routers. It is much easier to use hardware of exact type that is recommended by a service.
Hide My A$$ VPN service
Sorry but I know  nothing about these guys.
So, if I buy another router and plug it in behind the time capsule, this tells me that I would plug the new VPN  router into an Ethernet port on the time capsule.  Is this correct?
Yes, correct.
If so, then wouldn't the VPN router be nullified by the Time capsule?
No, the Time Capsule is totally invisible to the vpn tunnel.. which has the endpoint on the VPN router..
Please understand.. if the TC happened to have vpn end point.. it would still have the same IP address as given by your ISP as you have via the router behind it.
It is the VPN service that hides your address. To all the world your IP address is that given by the vpn service.. only the vpn service patches you to the internet and only they connect you. These sevices thus cover your local public IP with their own. You can use vpn service or proxy service or some DNS services to accomplish the same thing.
Port forwarding in the TC is the tricky bit.. and whether the particular firmware is going to break the vpn or not.
From a quick look at the website the vpn routers recommended are the same as for Strongvpn.. all have to be flashed over to dd-wrt.
http://www.hidemyass.com/vpn/software/routers/
I think if you are putting all traffic down the tunnel as this is suggesting, then it is pointless having the apple TC in NAT mode.. you are not going to be able to use it because every single item in your network will have to connect to the vpn.. assuming you are actually trying to hide all your traffic.