I have a GL.iNet Mango, which I think would suit your needs very well. (Either that or maybe a higher-spec router from the same company, anyway: the Mango lists VPN as a prominent feature so it's definitely got that covered, but it's only an 802.11N (300Mbps) device.)
The nice thing about GL.iNet routers is that they come with OpenWRT firmware already on them from the factory, so you can do whatever you want with them.
While I'm at it, here's an OpenWRT forum thread explaining how to adjust the firewall settings to act as a "killswitch."