Translations:FAQ/313/en

The most common scenario is: The leafs connect to the hub, with a fallback option to connect to each other in case the hub is down.
 * 2 leafs: for your clients
 * 1 hub: with no users, no DNS record published (if nobody knows the IP it cannot be attacked)
 * Services linked to the hub (running on the same machine as the hub)