I used a GL.iNet Brume 2 VPN router using version 4.x of the GL.iNet firmware like this.
Since the Brume 2 doesn't have wireless, I first connected to the Brume 2 LAN port to my Windows computer and connected to it's 192.168.8.1 admin page. I then setup the routers security page to enable all of the remote access control features so that I could access the Brume 2's admin page on it's WAN port. Then I connected the Brume 2 WAN port to my primary router's LAN network, and I setup a DHCP reservation on my primary router's LAN for the Brume 2's WAN mac-address so that the Brume 2 would always get the same LAN IP address which I used for admin and VPN access to the Brume 2. I then enabled the Brume 2's Dynamic DNS application feature and it registered the external IP address of the primary router's internet connection IP address on the glddns.com domain. I'm not sure if other GL.iNet routers will do this when connected behind another router, but the Brume 2 did. Then I setup port-forwarding on my primary router to allow the Brume 2's VPN server's configured local port to be allowed through the primary router to the reserved IP address of the Brume 2's WAN port.