Winston should always be installed behind a modem (or after any system that provides the same modulation/demodulation capabilities as a modem), via the WAN/IN port (the middle port, closest to the power adapter) on the back of Winston.
Any devices for which you want to provide filtering and anonymization as part of your Winston privacy network must be connected to Winston via the LAN/OUT port (farthest from the power adapter).
Typical configurations include:
Wall jack → Modem* → Winston → Computer
Wall jack → Modem* → Winston → Switch - Computers
Wall jack → Modem* → Winston → Router→ Computers
Wall jack → All-In-One Modem/Router (possibly in bridge mode+)* → Winston → Separate Router → Computers
Wall jack delivering internet line which has already been modulated/demodulated (such as a T1 line or Verizon Fios with a Verizon box outside house) → Winston → Router→ Computers
*any devices connected directly to this device will not be protected by Winston
+visit this article about using an All-In-One Modem/Router with Winston.