Is there a reason why I should run VPNs and Reflexive ACLs on a firewall with NAT + routing functions on the router, if the router alone can take care of it?