I want to implement a home alarm system with raspberry and access it from the external network. To do it safely I thought, avoiding using http that scares me, to use a vpn to connect to the home network and then ssh to connect from the home network to the raspberry. Plus I could use fail2ban and acl for more security. In this way, could I be calm? Is not it risky to connect the vpn to the router IP?
This isn't specifically a Raspberry Pi thing...
Critically, you should make sure that whatever you do, you don't rely on passwords alone. Either switch to certificate-based authentication methods -or- multi-factor authentication.
I've configured both VPN (OpenVPN) and ssh access to my network or to specific servers, but use certificates. On ssh, run something like DenyHosts which permanently blocks the IP address of anyone who is unable to authenticate after a few tries.
If you just need terminal access, then ssh configured with certificate-based authentication (don't allow username/password) and DenyHosts would suffice.
If you need desktop access, you can use something like TeamViewer ... but note that TeamViewer's defaults aren't secure (it does allow for two-factor auth'n but you have to configure it.)
A VPN (e.g. OpenVPN) would give you access to your whole network and let you run anything. But I would generate a self-signed CA and create a client certificate for your devices.
Any of these options will work on a Pi.
There are a number of ways to do this, and it's not so much the method you use, but rather how you secure it.
HTTP (preferably HTTPS) and VPN are two valid access methods. Either of these could be limited to accept connections from a single IP address (if you only connect from work for example), or limited to a small range of IP addresses.
You could also use client side certificates, username/password, Multi Factor Authentication, non standard port numbers and other techniques to further improve security. This might be a question for Information Security StackExchange...