Modem surge protection - RJ11 line-in or RJ45 line out?

Toasted!

For the 2nd time in a year, a lightning burned our router, amongst other devices.

We know that nothing can stop a lightning, but we want to protect as much as possible our equipment.

Lightnings come into the rack from the phone lines as we have surge protectors on the electricity lines, plus multiple UPSs with stabilizers.

As we have multiple VDSL lines (100Mb/s), we're wondering if it is better to protect line-in to the modem (RJ11) , risking a signal degradation or go for an Ethernet RJ45 surge protector on the modem output?

Any brand/model suggestion? We need 5.