Does a subscriber node in pglogical "pull", or are updates "pushed"? I've configured a simple pglogical replication between two nodes.

What I've not found yet is if the subscriber node pulls data, or if the publisher node initiates a push of data.

I'm intending to have geographically distributed nodes behind firewalls, which at this stage (without doing something like a VPN) would mean I have to have the subscribers pull data.
The subscribers initiate the TCP connection to the publisher.