In addition to
You also need a default route to xxx.xx.xx.14 (this builds on jjonsson assumption .13 is your WAN IP, more likely the GW is .13 and your WAN IP is .14)
The WAN interface might require proxy-arp
To not expose the ER to outside world, add WAN_LOCAL access list
