Hub will accept incoming connections from private address IPs and subnets explicitly defined by using /hub/allowSubnets?123.123.123.0,124.124.124.0 endpoint. Here, query string is a comma separated list of /24 subnets. So yeah, it can accommodate more complex network setups. It's simple source IP filtering on the hub side.