Andy's point is valid, I deliberately avoid commercial vpn companies as they likely are to attract attention from authorities. Instead I lease a vps, server whatever and setup my own vpn. some random vps wont get the same kind of attention. Also I can be sure both ends are configured for my own needs, and no logging etc.
Anyway to help with the OP, what kind of router does your friend have? I think its hard to answer here because every router brand is different in the sort of options they expose, and how to setup is also dependent on the vpn server used, commercial providers tend to have documentation on their sites to help setup the vpn.