1) is the "router" in routed mode, or pass-thru? The easiest way to tell is whether you get a public IP on your box when you get an IP -- if you do get a public IP, then its in pass-thru mode.
2) Regardless of whether you're in routed or pass-thru mode, you should probably stand-up a firewall between their link and you. My advice: subscribe to a VPN service and have your firewall automatically establish a VPN to said service so everything leaving your local link is encrypted. This prevents the NSA (or its local equivalent) from being able to eavesdrop your link.
3) If you can spring the cash, get a commercial firewall such as a Palo Alto Networks PA-200 or a SonicWall NSA220. If you can't, take an old workstation and throw a second NIC in it and load your *nix of choice (pf-tables makes a great little firewall.)