HPM comes with a VDSL "modem" and a CTU which works like a router. This means that the CTU is getting the public IP and not my BSD firewall, and of course meant that VPN connections to the firewall had no chance of succeeding. I hoped that I would be able to change the CTU from a router to a bridge but there was no obvious way to do this. There is also no VPN passthrough option on the CTU.
This morning I did a bit of digging around on the web and it is possible to change the way the CTU works in such a way that my firewall gets the IP and the CTU just sits there invisibly, essentially turning it into a bridge.
In your browser on the CTU configuration page this is what needs to be done:
1) Disable the CTU's firewall
2) Turn on the CTU's PPPoE service option
3) Disable (or just delete) all the ISP login settings in the CTU
4) Save the CTU settings
Once the above is done you can configure your own firewall/router to connect to your provider via PPPoE as if the CTU was not there. Your firewall will be assigned the global IP and you can access it remotely for VPN or other uses. You may need to reduce your firewall's WAN MTU to around 1438 due to the additional overhead, just experiment to see what level avoids packet fragmentation and increases VPN stability.
I hope this helps someone! I now have a dirt cheap connection that gets 50Mbps down and about 25Mbps up. Not as fast as a dedicated hikari connection would be but much faster than ADSL was and more than fast enough for my new VPN requirements.
