As Michael's implied, you can ignore the SureSignal. It will set up the connections it needs like any other device. I recently got one and had all sorts of problems with it, and read on their forums (and was advised by Vodafone themselves) about opening all sorts of ports to the SureSignal (which would indeed have taken the ports normally used for incoming VPN). But it was all a red herring.... it's not quite so badly designed as gthey make out! The SureSignal hadn't registered correctly at Vodafone and they had to "re-sync" it. Then it sprang to life and has been great since, with absolutely no configuration on my router whatsoever (though I assigned it a static local internal 192.168. IP).... leaving all the (main) ports available for me to do what I like. Generally the SureSignal just maintains one connection using port 4500 (but because of NAT, actually some random port on the router is used, hence not occupying inbound port 4500).
Not sure many (any??) "standard" (aka free) routers given away by ISPs will offer VPN in, but the majority of ISPs let you use whatever router you fancy, so if you need VPN in, I'd recommend buying your own router. I have a Draytek 2860 which gives me many VPN options for inbound as well as network-network connections, plus all the internal configuration I want. I use it with Zen as my ISP, who provide all users with a static IPv4 address.... and a block of IPv6 too if you want it. Not the cheapest option, but works well. My experience is that it provides a much better connection than the free Zyxel I was given too.