Hub-and-Spoke VPN
Every branch connects to one central gateway.
How widely is it used?
Common in production todayThe most common branch topology — simple to run and to inspect centrally.
How it works
Each spoke holds a single tunnel to the hub. Spoke-to-spoke traffic is hairpinned through the hub, which keeps configuration small and inspection central.
Connects
Branches → central hub
Protocols
IPsec, WireGuard, DMVPN
Typical users
Retail chains, Enterprises with many small sites
Main use case
Centralised branch connectivity and traffic inspection.
Advantages
- Simple topology, N tunnels for N sites
- One place to apply security policy
Limitations
- Hub is a bottleneck and single point of failure
- Adds latency to branch-to-branch traffic