Pi is not a router. it only has a single lan port. It also does NOT have hardware accelerated encryption. VPNs are crippled in speed due to this.
FriendlyElec have a range of dual port routers like the R4S and R5/6 series. Any of them will kick a pi into a cocked hat. The newer R5/R6 also have 2.5Gb LAN.
Add a high speed switch and dedicated AP like a Ubiquiti and you have a robust network solution.