According to the screenshot of your configuration, it seems all good... Connecting directly to your router has no such a problem? IP address on all your wireless clients are obtained automatically or...

The same application here? http://forum.tp-link.com/showthread.php?82344-TP-Link-150mbps-Wireless-N-Nano-Router-(TL-WR702N)-AP-problem If so, you need to use WA850RE as an access point?...

Are they https websites or http websites? The router can block http websites without a problem. http://www.tp-link.com/en/faq-273.html

Can you login web interface of MR3020? Check if the modem is identified or not. http://www.tp-link.com/en/faq-748.html

What kinds of VPN connection are you trying to create? WR842 Supports: 1. VPN Pass-Through PPTP, L2TP, IPSec(ESP Head) 2. VPN 5 IPsec VPN Tunnels

Your WR841N is too old and I don't think any new features will be added in future.