@Looter 

Hi,

Yes, you are right.

If you want to use the VPN server feature, then set the AX50 up in Router Mode and connect the AX50's WAN port via Ethernet cable to the LAN port of the ISP router. It would be best to configure a static IP address for the AX50's WAN port, so that it will never change. Then go to the ISP router and forward the relevant port(s) to the AX50's WAN IP address.

Sometimes it's also possible to setup the ISP's router in so-called "bridge" mode and then let the own router handle the Internet connection (i.e. via PPPoE or whatever the ISP requires) which would make the port forwarding obsolete and get rid of one instance of NAT. But this depends on whether your ISP supports this mode.