If he’s smart enough to bypass by use of VPN, then any steps you take will likely be circumvented, especially since the router has limited capabilities compared to small business grade routers. Even in a large company with an IT team it’s possible for people to bypass and disrupt the security measures put in place, what generally stops them is the consequences which include disciplinary action. You may well find that whatever router you use, your son may always find a way round the obstacles you put in the way, for example temporarily connecting the modem Ethernet cable to a router LAN port could allow him to bypass the router completely.
