I began with the VoIPo provided GS ATA ahead of the router. But this exposes the ATA to the Internet's bad guys' attacks. And the passwords for admin and so on are universal and easily leaked.

My router is my main line of defense. Its remote admin is disabled.