SuperHub VPN Access – Fast Secure Home Network 2026

NordVPN is the best VPN for Virgin Media SuperHub access for most households, particularly if you want to place a VPN-capable router behind a Hub 3, Hub 4, or Hub 5 and protect devices without installing a VPN app on each one. ExpressVPN is the more interesting choice when you want dedicated VPN-router hardware with minimal manual configuration, while Surfshark works well when your own router supports manual VPN profiles and you want to control which household devices use them.

The important limitation is that a Virgin Media SuperHub is primarily ISP-supplied gateway hardware, not a general-purpose VPN client router. VPN passthrough lets phones and computers establish their own VPN connections through the Hub, but that is different from configuring the SuperHub itself to send the entire home network through a commercial VPN. For whole-home VPN routing, the cleaner setup on compatible Virgin hardware is normally SuperHub in modem mode → your own VPN router → home devices.

Best VPNs for SuperHub access compared

Why SuperHub VPN access is different from installing a VPN app

Installing a VPN application on a laptop connected to a Virgin Media SuperHub requires very little from the Hub itself. The laptop creates the encrypted tunnel, while the SuperHub simply forwards the traffic to Virgin Media.

Whole-home VPN access changes the architecture. The device creating the VPN tunnel is now the router serving the household, which means the router must support a VPN client, not merely VPN passthrough.

That creates three distinct SuperHub configurations:

• VPN app behind the SuperHub: the SuperHub remains in router mode and an individual phone, computer, or tablet creates the VPN tunnel.
• VPN router behind the SuperHub: your own router establishes the VPN connection and routes selected or all downstream devices through it.
• Remote VPN into your home: your own router or server accepts incoming VPN connections so you can reach the home network while away.

The second and third configurations are where modem mode becomes particularly important. A Hub 3, Hub 4, or Hub 5 can be changed from a combined modem/router into a modem-only device, allowing your own router to receive the external connection and take responsibility for NAT, DHCP, Wi-Fi, firewall rules, and VPN routing.

1. NordVPN – best VPN for SuperHub access overall

Visit NordVPN

NordVPN takes first place because it supports the kind of third-party router ecosystem that makes sense when replacing the routing functions of a Virgin Media SuperHub.

NordVPN documents router configurations for ASUS WRT, ASUS Merlin, DD-WRT, Gl.iNet, MikroTik, NetDUMA, OPNsense, OpenWrt, pfSense, DrayTek, EdgeRouter, TP-Link, Tomato, and several other platforms. That matters here because the SuperHub does not need to understand the NordVPN configuration at all. Its role can be reduced to delivering the Virgin Media connection to your downstream router.

A typical setup is:

Virgin Media cable → Hub 3/4/5 in modem mode → NordVPN-compatible router → Ethernet/Wi-Fi devices.

This is cleaner than leaving both devices performing routing. Your own router receives the WAN connection, creates the VPN tunnel, assigns local addresses to the household, and determines which devices use the VPN.

NordVPN’s own documentation also makes an important distinction for SuperHub owners: ISP-provided routers commonly lack the ability to configure a VPN client. VPN passthrough is not enough. The downstream router needs actual OpenVPN-client or other supported VPN-client functionality.

Best fit: Virgin Media users with a Hub 3, Hub 4, or Hub 5 who are prepared to use modem mode and want broad flexibility when choosing the router that handles the VPN.

2. ExpressVPN – best if you want dedicated VPN-router hardware

Visit ExpressVPN

ExpressVPN is particularly relevant to SuperHub users who want to replace the Hub’s router and Wi-Fi functions without turning the project into a manual OpenVPN configuration exercise.

The important architectural point is that a VPN-router product such as ExpressVPN’s router-focused hardware sits after the Virgin Media Hub. On a compatible Hub, modem mode gives the downstream VPN router the cleanest possible position in the network.

This avoids one of the most confusing SuperHub installations: connecting a second router while leaving the Virgin Hub in router mode. That configuration can work, but both devices may perform NAT and maintain their own private subnets. Remote access, port forwarding, gaming services, local discovery, and inbound VPN-server configurations then become more complicated.

With the Hub in modem mode, those routing decisions move to one device.

For households where TVs, streaming boxes, games consoles, phones, and computers all depend on the same router, that is normally easier to reason about than maintaining VPN applications separately across every platform.

Best fit: SuperHub users who want the Virgin hardware to act primarily as the broadband handoff while a dedicated VPN-capable router controls the home network.

3. Surfshark – useful for selective VPN routing behind a SuperHub

Visit Surfshark

Surfshark is a good match when the purpose of replacing the SuperHub’s routing layer is not necessarily to force every device through one VPN server.

A capable downstream router can separate devices into different routing policies. For example, a streaming device might use one VPN profile while a work laptop follows the normal Virgin Media connection and a games console bypasses the tunnel entirely.

The SuperHub itself is not where this policy is created. Once it is operating in modem mode, the routing intelligence belongs to the downstream router.

That distinction matters because many users search for a “SuperHub VPN setting” expecting to find a menu where individual devices can be assigned VPN servers. Virgin Media’s own Hub interface instead concentrates on broadband, Wi-Fi, security, and local-network settings. The more advanced client-routing policy has to come from the replacement router.

A router with multiple VPN-client profiles or policy-based routing therefore makes Surfshark considerably more useful than simply adding a second generic Wi-Fi router behind the Hub.

Best fit: households that want their own VPN-capable router behind a SuperHub and intend to divide VPN and non-VPN traffic by device.

4. ProtonVPN – best for a configurable replacement-router setup

Visit ProtonVPN

ProtonVPN makes the most sense for SuperHub owners already planning to move routing to flexible hardware such as OpenWrt, pfSense, OPNsense, or another router platform with proper VPN-client support.

In that arrangement, the Virgin Hub is deliberately kept out of the VPN configuration.

This separation has a practical advantage when troubleshooting. If the Virgin connection is online but devices behind your router cannot reach the internet, you can distinguish between:

• the Virgin Media broadband link;
• the Ethernet handoff from the SuperHub;
• the WAN configuration on your router;
• the ProtonVPN tunnel;
• the routing policy assigned to the affected device.

That is far easier to diagnose than a double-NAT network where the Virgin Hub and your own router both assign addresses and maintain firewall state.

A configurable router also gives you more control over what should happen when the VPN tunnel is unavailable. Depending on your router configuration, traffic can either be blocked or deliberately fall back to the ordinary Virgin Media route.

Best fit: technically confident SuperHub users who want the downstream router, rather than the ISP gateway, to control VPN interfaces and routing rules.

5. Private Internet Access – best for detailed downstream routing control

Visit Private Internet Access

Private Internet Access fits a SuperHub installation where the reason for using another router is control rather than simply extending Wi-Fi coverage.

That distinction is important. A mesh system running only as access points may improve wireless coverage while leaving routing on the Virgin Hub, but it does not automatically create a router-level VPN client.

For PIA to cover devices that cannot run the native application themselves, the downstream device has to operate as a router and establish the VPN connection.

That can be useful for equipment such as smart TVs and other fixed home devices where installing a normal VPN application is not practical.

The most straightforward topology remains:

SuperHub modem mode → VPN router → switch/mesh/access points → household devices.

Putting access points or Ethernet switches after the VPN router keeps one routing boundary. Putting another full router between these layers introduces additional NAT and makes troubleshooting considerably harder.

Best fit: users building a more deliberate home network behind Virgin Media rather than relying on the SuperHub as the final router.

6. CyberGhost – suitable for a straightforward manual router profile

Visit Cyberghost

CyberGhost is relevant to SuperHub users who already own a router capable of importing manual VPN configurations and mainly want to place that router cleanly behind the Virgin connection.

The critical check comes before choosing the VPN provider: verify that the downstream router is a VPN client.

A specification page that says “VPN passthrough” is insufficient. Passthrough merely means a connected laptop or phone can establish its own VPN connection through the router. It does not mean the router can log into CyberGhost and route another device through that connection.

This is particularly easy to misunderstand when upgrading from a Virgin SuperHub to a consumer mesh system. Some mesh products provide excellent Wi-Fi and still lack a usable VPN-client function.

If that happens, putting the SuperHub into modem mode has not solved the entire problem. You have removed Virgin’s routing layer, but the replacement hardware still needs the required VPN functionality.

Best fit: households that already know their replacement router supports manual VPN-client profiles and want a relatively conventional SuperHub-to-router topology.

7. IPVanish – useful with third-party router firmware

Visit IPVanish

IPVanish is most relevant when your Virgin Media connection already feeds a router running firmware designed for more advanced network configuration.

DD-WRT and similar installations are fundamentally different from simply using the SuperHub’s built-in Wi-Fi. Your router becomes the network gateway and the Virgin device is reduced, where modem mode is available, to the broadband side of the connection.

That gives you a clear place to manage the VPN tunnel.

It also means a failure can affect more devices at once. If the downstream router has a policy that prevents fallback when its VPN tunnel fails, every device assigned to that route can simultaneously lose internet access even though the Virgin Media connection itself remains online.

Checking the router’s WAN status before rebooting the SuperHub prevents unnecessary broadband troubleshooting.

Best fit: Virgin Media users who already use DD-WRT or another configurable router platform and want the VPN handled at that gateway.

Can you install a VPN directly on a Virgin Media SuperHub?

Not in the same way you can on a purpose-built VPN router.

The crucial distinction is between VPN passthrough and a VPN-client configuration.

Virgin Media itself advises checking router compatibility when using VPN services and notes that ISP hardware may require passthrough or separate VPN-capable equipment.

SuperHub router mode vs modem mode for VPN use

Choosing the correct mode changes the entire topology.

SuperHub in router mode

In router mode, the Hub creates the local network. Devices normally receive private addresses from it, and the Hub performs NAT between the home network and Virgin Media.

You can still run NordVPN, Surfshark, ExpressVPN, or another VPN application directly on individual devices.

You can also connect another router behind the Hub, but unless the downstream device is deliberately configured as an access point, you can end up with two routing layers.

SuperHub in modem mode

In modem mode, the Hub stops acting as the household router and your own router takes over.

Virgin Media’s current instructions support modem mode on Hub 3, Hub 4, Hub 5, Super Hub 1, Super Hub 2, and Super Hub 2AC. Virgin states that it is currently unavailable on Hub 5x.

Once modem mode is active, Virgin Media documents the Hub management interface at 192.168.100.1 rather than the usual 192.168.0.1 used in router mode.

That address change is worth remembering. Being unable to open 192.168.0.1 after enabling modem mode does not necessarily mean the Hub has disappeared from the network.

Hub 5 vs Hub 5x is critical for a VPN-router setup

The similar names hide an important difference.

Virgin Media Hub 5 and Hub 5x should not be treated as interchangeable when planning a whole-home VPN network.

Virgin Media’s current support documentation lists modem mode for Hub 5 but explicitly says it is not currently available for Hub 5x.

This matters because many clean VPN-router designs assume that the ISP gateway can be converted into a bridge or modem-only device.

With a normal Hub 5, the intended topology can be:

Virgin Media → Hub 5 modem mode → VPN router → home network.

With a Hub 5x, you cannot currently assume the same modem-mode option exists. A design based on replacing the Virgin routing layer therefore needs to account for the exact Hub model before buying additional router hardware.

Why double NAT can cause problems with a SuperHub VPN router

A common configuration is:

Internet → SuperHub router → second router → devices.

If both boxes operate as routers, the downstream router receives a private address from the SuperHub and then creates another private network for its own clients.

For ordinary outbound browsing, this can appear to work perfectly.

The difficulties become more obvious when you use:

• a VPN server for remote access to your house;
• port forwarding;
• games or applications requiring inbound connections;
• local services that need discovery across network segments;
• devices behind different routers;
• routing rules that depend on the VPN router seeing the actual WAN side of the connection.

If your Hub supports modem mode and your goal is to make your own router the permanent gateway, eliminating the first routing layer is normally cleaner than building around double NAT.

How to structure a fast SuperHub VPN home network

The VPN tunnel should not automatically be blamed for every speed problem. In a SuperHub installation there are several separate links that can constrain throughput.

This is why testing only over Wi-Fi can give a misleading diagnosis.

First test a wired device through your own router without the VPN tunnel. Then enable the VPN and repeat the test. That separates the Virgin connection and Ethernet path from the encryption workload performed by the router.

If the non-VPN wired speed is already unexpectedly low, changing VPN providers is unlikely to solve the underlying SuperHub-to-router problem.

Using a SuperHub when you want remote VPN access to your home

There is another SuperHub VPN use case that is completely different from routing household traffic through NordVPN or another commercial provider: connecting back into your own home while away.

In that configuration, your home router, NAS, firewall appliance, or server acts as the VPN server.

With the SuperHub still operating as a router, inbound connections may need to pass through its NAT and firewall before reaching the VPN server behind it.

Putting a compatible SuperHub into modem mode can simplify the topology because the downstream router becomes the device directly responsible for the public-side connection.

This is especially useful when the same router is running an OpenVPN or WireGuard server for remote access.

Virgin Media also warns that when a Super Hub or Hub 3 is used in modem-only mode, its normal router firewall is no longer providing protection; the directly connected router or device therefore needs its own firewall.

What to do if your VPN stops working behind the SuperHub

The VPN app works on mobile data but not through Virgin Media

First determine whether the problem affects one device or every VPN-capable device on the SuperHub.

Virgin Media provides Online Security controls and notes that VPN usage can be allowed from the account’s security settings. If a VPN suddenly fails only on the Virgin connection, checking those account-level controls is more useful than repeatedly reinstalling the VPN application.

Your VPN router has no internet after enabling modem mode

Check the WAN side of your own router before changing the VPN configuration.

The replacement router has to obtain its upstream connection correctly before NordVPN, Surfshark, ExpressVPN, or another tunnel can work.

Also verify that you are actually using a Hub model that supports modem mode.

You cannot open 192.168.0.1 anymore

If modem mode is active, use 192.168.100.1 for the Virgin Hub administration interface.

That behavior is documented by Virgin Media and is normal after moving the Hub out of router mode.

The internet works but router-level VPN speed is much lower

Test the Ethernet path first.

A VPN router performs encryption for every device using the tunnel, so its CPU and VPN implementation can become the bottleneck even when the Virgin Media line itself is much faster.

Compare:

• wired speed through your router without VPN;
• wired speed through the router with VPN;
• Wi-Fi speed without VPN;
• Wi-Fi speed with VPN.

That sequence tells you whether the limiting factor is the Virgin connection, the router, the VPN processing, or the local wireless network.

Remote OpenVPN or WireGuard stopped after the SuperHub returned to router mode

Check the network topology before changing certificates or VPN keys.

If a VPN server is hosted on your own router and the SuperHub is unexpectedly operating as a router again, the server may now sit behind an additional NAT layer. Incoming connections that previously reached your router directly may no longer follow the same path.

Which VPN should you choose for SuperHub access?

For most users building a whole-home VPN network behind a Virgin Media Hub, NordVPN is the strongest overall choice because it has extensive documentation for the third-party router platforms that are actually relevant when the SuperHub is moved into modem mode.

ExpressVPN is more compelling when you want dedicated VPN-router hardware and prefer to replace the SuperHub’s routing role with a system designed around VPN use.

Choose Surfshark if your downstream router gives you good device-level routing controls, or ProtonVPN if you are building the network around configurable router or firewall software.

Before buying anything, identify the Virgin Hub model. The difference between Hub 5 and Hub 5x is more important to this setup than small differences between VPN providers because Virgin currently documents modem mode for the former but not the latter.

Frequently asked questions

Can I put NordVPN directly on a Virgin Media SuperHub?

A Virgin Media SuperHub should not be treated like a normal configurable NordVPN router. The common solution for whole-home NordVPN coverage is to use a separate router that supports a VPN client and, where the Virgin Hub model allows it, put the Hub into modem mode.

Does Virgin Media SuperHub support VPN passthrough?

VPN passthrough and router-level VPN support are different features. Passthrough allows a computer, phone, or other device to establish its own VPN connection through the Hub. It does not mean the SuperHub itself can connect the entire household to NordVPN, Surfshark, or another commercial VPN.

Should I use modem mode for a VPN router?

If your SuperHub supports it and you want the second router to control the entire home network, modem mode normally creates the cleaner topology. It removes the SuperHub’s routing layer so your own router can handle NAT, firewalling, DHCP, Wi-Fi, and VPN routing.

Does Virgin Media Hub 5 support modem mode?

Yes. Virgin Media’s current support documentation includes the Hub 5 among the models that can use modem mode.

Does Virgin Media Hub 5x support modem mode?

Virgin Media’s current instructions specifically state that modem mode is not currently available for the Hub 5x. Do not assume instructions written for the Hub 5 apply to the similarly named Hub 5x.

What IP address do I use to access a SuperHub in modem mode?

Virgin Media documents 192.168.100.1 for accessing the Hub settings after modem mode has been enabled. In normal router mode, the usual management address is 192.168.0.1.

Why does my VPN work on a PC but not when I configure my router?

A VPN application running on the PC creates its own tunnel. Router-level VPN requires the router itself to support a VPN client and the provider’s configuration method. A specification that only mentions VPN passthrough does not provide that functionality.

Can I run a VPN server behind a Virgin Media SuperHub?

It is technically possible to run a VPN server on your own router or another device behind a Virgin connection, but the routing topology matters. If the SuperHub remains in router mode, inbound traffic must traverse that routing layer. On compatible Hub models, modem mode can simplify the setup by making your own router the primary gateway.

Will modem mode make my VPN faster?

Not automatically. Modem mode simplifies the network architecture, but VPN throughput still depends heavily on your downstream router, its CPU, the protocol it supports, the selected VPN endpoint, and the Ethernet and Wi-Fi links serving your devices.

Do I still need a firewall when the SuperHub is in modem mode?

Yes. Virgin Media warns that the Hub’s normal router firewall does not provide the same protection when it is operating in modem-only mode. The router or firewall appliance connected directly behind it should therefore provide the firewall for your home network.