Routers which can accept the "Merlin" firmware seem to be regarded as rather good for VPNs. This includes ASUS routers, as well as a select few others with very similar hardware (eg. Netgear R7000, very similar to the ASUS RT-AC68U).

I have an AC68U here (actually, a T-Mobile AC-1900 by name, identical hardware though). Nice router, lots of horsepower, VPN client/server in the web GUI, along with capabilities for selective VPN routing: deciding what goes via VPN, versus what doesn't. Eg. this BBS rejects my connections from the VPN, so I could set rules to bypass VPN for empegbbs.com.

As a bonus, this router also accepts TomatoUSB and DD-WRT firmware, among others. The Netgear R7000 and ASUS RT-AC68U are very much the choice of 3rd party firmware developers, which means pretty good to excellent support for them.

I haven't used the VPN setup in the router yet though.