http://technet.microsoft.com/en-us/library/bb123494.aspx
Deployed inside your Active Directory forest, the Hub Transport server role handles all mail flow inside the organization, applies transport rules, applies journaling policies, and delivers messages to a recipient’s mailbox. Messages that are sent to the Internet are relayed by the Hub Transport server to the Edge Transport server role that’s deployed in the perimeter network. Messages that are received from the Internet are processed by the Edge Transport server before they’re relayed to the Hub Transport server. If you don’t have an Edge Transport server, you can configure the Hub Transport server to relay Internet messages directly or utilize a third-party smart host. You can also install and configure the Edge Transport server agents on the Hub Transport server to provide anti-spam and antivirus protection inside the organization, although this isn’t recommended.
You can install the Hub Transport server role on the same hardware with any other internal server role or on a server that’s dedicated to the Hub Transport server role. You must deploy a Hub Transport server role in each Active Directory site that contains a Mailbox server role. Deploying more than one Hub Transport server per site provides redundancy. When you install more than one Hub Transport server in an Active Directory site, the connections are distributed.