Question: Use of a Router is the first solution for adding a security layer to any LAN with N machines, connected to the internet (through its firewall settings). My question is does the WAN to LAN conversion and vica versa, adds any security by itself, and what is it exactly?

Answer: 
If I understand your approach and code correctly then you simply don't use the original passphrase for "encryption" but a key derived from passphrase and a static salt. This approach of not using the original passphrase but a derived key is also called key stretching using a [key derivation function](https://en.wikipedia.org/wiki/Key_derivation_function). The purpose is to make a "better" key by hiding a not so random passphrase behind complex operations which purposely take a long time and thus make brute forcing the original passphrase harder. The derived key is then used for encryption, but still with a good encryption algorithm.

Unfortunately the way you have used these ideas is wrong. You are not using the derived key in a strong encryption but only in a simple operation like XOR. This simple kind of "encryption" makes it easy to get the encryption key (i.e. the key derived from passphrase and salt) if enough encrypted data are known or if a few plain text is known. Once the attacker has this derived key it can decrypt all data, i.e. there is no need to find out the original passphrase and salt used for creating this key. 

Apart from that your key derivation function is a fast hash which would make brute forcing easier. But again, one don't even need to reverse your key derivation to decrypt the content.
The key feature of hashes are that they are irreversible, so using this method to "decrypt" data would leave you in the same position that your adversaries are, which is brute-forcing the message.

You might argue that you have the upper-hand in that brute-force competition by "knowing" the password that was used in the hash as a *"salt"* of sorts, but if you could secure transmit that salt to the target endpoint securely, why not use that secure channel for the actual data?