All routers must support VPN passthrough at the least. The majority of recent routers do. If they don't then you cannot use 'AH' (authentication headers) as the NAT causes mismatches in the IP addresses. Not using AH renders your encrypted packets susceptible to man in the middle and spoofing attacks.