Enable a VPN on all the net

I have configured OpenVPN on the Orbi, and I fear this is not what you want.  OpenVPN is a server that allows users to come into the Orbi from outside over an encrypted channel (VPN).  So, someone sitting in a coffee shop, airport, etc. can connect to their home Orbi and the entire pathway from that location to the Orbi is encrypted and cannot be "spied on."  Once inside the Orbi, they can access local resources or they can go back out from the Orbi to the internet.  THAT communication is not encrypted, except of course for things like HTTPS web sites.  Almost everything these days that involves sensitive information is done over HTTPS.

I may be mistaken, but it sounds to me like what you want is to have every device in your network communicate with the internet over an encrypted channel.  In that case, the VPN host is "outside", not inside the Orbi.  Those commercial VPN's encrypt the traffic from the user to the VPN host, change the IP address, strip out personal information, and then send the data on toward an internet host unencrypted.

I hope one of the more sophisticated forum members will chime in with a solution for you.