u/Individual_Fun8263, you should make sure in your research, that whichever hardware, ie. Router that you select for your home network, that it’s Firmware will have VPN support and actually most of the known OEM Router brands will have such capabilities built in their Firmware already.
For example, in our household, we have a VPN setup at the router level (ie. the router’s firmware already has this built in support). As a result, then on our mobiles Phones, we have a VPN connection configured that allows those devices to VPN directly to our home VPN. Once connected, then regardless where we may be, even on the other side of the planet, once that we connect to the home VPN, then it will be as if we were locally connected right at home and as a result, for example, we can Wake On LAN (WOL) the home devices, ie. NASes, other home PCs, etc and remotely use it, from wherewever we may be, without having to have traveled with all of those devices themselves and just access them remotely. Once we are done with the work, then we can power those devices down (to save power and not let them running at home) and last, disconnect from the VPN.
‘However, wondering about the best way to protect mobile devices.’
With all that said, a VPN doesn’t necessarily ‘protect’ a device, whether that device may be a mobile device, or PC, Tablet, etc. A VPN, as it name implies, just creates a Virtual Private Network, thus moving your IP address from whereever a device may be and places that device, through that tunnel, at the destination IP, just as I mentioned in the example, for example, we live in Europe and if we were traveling and find ourselves in South America and VPN to our home router, then through that VPN tunnel, the connected devices (mobile, pc, tablet, etc) will appear as if it were logged in right at home in Europe and NOT in whereever we may be traveling in south america → this doesn’t necessarily mean that those connected devices are ‘protected’, just the devices are connected via a tunel from Point A to Point B.
Where the inherit ‘protection’ that we can mention, may be, is that for example, if we were connected to a public WiFi, for example in a hotel, Airport, Webcafe, etc and through that connection we then connect via VPN to our local network at home, then since all that traffic is traveling inside the VPN tunnel, then all that traffic traveling inside the VPN tunnel is not seen by that ‘public’ network as all they can see is the presence of a VPN tunnel/traffic, but not the actual data that is traveling through that tunnel. Under that context, then it can be agreed that there is a ‘protection’ in that sense, that your data will be much more secured, but still, whichever traffic/activity that you may be doing, is still being seen at end end location, ie, any webbrowsing that we are doing while connected via VPN to our home router, will be then coming out at the other end of the VPN tunnel of our home network right at home and that traffic will be seen by the ISP that provides that home internet access at home.
Therefor, those VPN Services that are available, will allow you still the same principle, of a VPN tunnel to one of their available servers, which will still have the same principle, to place your traffic from whereever you may, aka Point ‘A’ be to one of their servers that may be in a different location, aka. Point ‘B’.