arqteqnet

I've tested this and it works as expected with multiple hubs to same radius server.

Deploy freeradius and a 2fa service on the vpn server. As long as you have a backend user store you'll be able to use 2fa if sending passwords in clear...