Good to hear you got it working OK. I also use a 2960 with a Virgin Media account, albeit a business account so have the Hitron from VM. It works well in that config - but if you want to use the 2960 as a VPN endpoint you might want to load the 1.4.1 BETA firmware.

1.4.0 stopped VPN working for me, but 1.4.1 beta restored that.

Yes nice one.

Another thing I learnt about the connection in modem mode, is it seems to have a timer for the last MAC address, which hinders plug and play. If the 2960 (Can't imagine it would change itself), had its WAN MAC changed, or you even plugged it into two instead of one, the SH see this, and does not allow the connection always. The way to work around this is to switch back to router mode, reboot, test for connectivity, then back to modem mode, thus looking for any MAC.

silverstreak_2006 wrote: I can't understand why you would have issues. Make sure you have routing policies if you use more than one LAN. The Draytek see beyond the Public IP, so needs to be forced to WAN2 to work, and the SH does its unusual thing when it sees that 100.1 address come its way.

Very useful to find this thread, thanks, as I have been dealing with the same problem. Actually turned out much easier than I expected - As soon as the Virgin Superhub in modem mode was plugged into WAN2 with the port set for "static or dynamic IP" everything pretty much worked. As you say, I'm still able to access the SH admin page at 192.168.100.1 from the LAN side of my Vigor 2860 without any difficulty. The thing is, I'm not sure why! I full expected to have to mess around with disabling NAT for the appropriate address ranges, setting up the IP routed subnet, etc. but it seems not. Does the 2860 simply route any private (192.168.x.x) IP traffic for address ranges not included in a specifically defined LAN across to the WAN? Certainly, as soon as I define a new LAN that includes 192.168.100.1, I can no longer access the Virgin hub.

IanDL wrote: The thing is, I'm not sure why! I full expected to have to mess around with disabling NAT for the appropriate address ranges, setting up the IP routed subnet, etc. but it seems not. Does the 2860 simply route any private (192.168.x.x) IP traffic for address ranges not included in a specifically defined LAN across to the WAN?

I did a bit of playing around - using both a 2830 and a 2860, each reset to default and connected to a Hub 3 in modem-mode. They both exhibit the same effect ... the 'magic' is being done by the Hub 3, not the Vigor.

In the absence of any other routing information, requests for 192.168.100.1 are targeted directly at the Default Gateway defined by Virgin Media. (No attempt is made to 'ARP' for 192.168.100.1 on the WAN port - the Vigor has no knowledge of such a network existing there). The Hub 3 then steps in and intercepts this traffic ... responding to it itself. I can see data leaving the 2860 (or 2830) destined for some Cisco kit off-site, but mysteriously, the response is from the Arris kit (Hub 3) on-site. If I break the Virgin Media cable connection, this continues to be the case... so it's definitely happening 'on-site'.

Was this behaviour was present in any previous Virgin Media kit? ...

I've been doing a bit of playing around too!

Looking at the 2860's routing table (should have done this earlier) I see there is a default rule that sends addresses in the range 0.0.0.0/0 via the default gateway over the WAN. This address range includes, basically, everything. There are then additional rules directing the LAN ranges I have defined to the LAN ports of the 2860 rather than the WAN. The upshot of this is that as long as I don't define a LAN that includes 192.168.100.1 in it's address range, traffic to this address will be directed to the WAN port and then intercepted by the Hub3. Basically what I suspected but didn't realise the 2860 had a default rule directing everything (including addresses in the private IP range) to the WAN unless you tell it to do otherwise. Obvious really, I guess.