I'm not sure where the .40. address is coming from. My Arris modem's admin page lives at 192.168.100.1. I don't need to do anything to my router to access it.
The router knows that it doesn't own a 192.168.100.x subnet and forwards that traffic 'toward' its default router, where the modem will reply. Not all modems use the .100. subnet. Arris and Motorola do.
In a typical (Arris/Motorola) config, if you watch the ethernet traffic while the modem is coming up and the router is DHCP'ing for its WAN address, you will see the WAN get 192.168.100.xx address until the modem negotiates with the ISP. The modem will then drop and restore link to the router forcing the router to do another DHCP request. The response to this second DHCP request receives the public IP address for the router's WAN port.
If you run wireshark on a PC connected to the modem while powered off, then power on the modem, you should see a gratuitous ARP advertising the modem's IP and MAC addresses. This will probably be the management IP address of the modem.