Site to Site VPN behing a Verizon Router

My internet service is provided by Verizon FIOS and my Internet router is a G3100, I have 2 GL IX-1800 VPN routers in 2 locations and want to establish a site to site VPN. Can I have the VPN tunnel established BEHIND the Verizon Router doing NAT? (meaning the WAN port of GL 1800 is connecting to the LAN port of the Verizon router) or is the GL-1800 VPN Server WAN must be connected to the WAN port only? The reason I want to keep the Verizon Router in the picture BEFORE the GL-IX1800 is because I want some of the internal traffic to NOT go through the tunnel (WIFI).

You need to add port forward at Verizon Router.