Core node and relay nodes
As described in the image below, every core node needs to be connected to (and only to) one or more relay nodes controlled by the stake pool operator. This is to keep the core nodes protected from the rest of the internet. You can use a firewall to protect your core node.
In the other hand your relay nodes can (and should) be connected to other relay nodes in the network.
Each node must run in its own dedicated machine or server.