In NYC we have a similar problem. We are unable to connect directly to our smaller hubs via RF.
A solution we are working on is based on OpenVPN. We don't have it in production yet but it looks good so far. Our central hub (
n2nov.ampr.org) actually lives in a data center and so has no RF abilities but it is the master gateway for our subnet and mail repo etc. The borough hubs should connect back to the central hub over the Internet. This means that our entire City wide network can function in the same way at every node/hub. We also don't have to worry about varying infrastructure abilities at each site as the OVPN client runs directly on the hub box. We use JNOS and Debian.
In short, our gateway will handle all the external linking and borough-to-borough connections which means that we only need user access ports. In the event that we need a backup RF outlet we are able to connect to a partner gateway in NJ which in turn has HF/VHF/Internet abilities.