An authenticating proxy or a VPN in front of self-hosted web apps?
A VPN hides services completely and protects any protocol; an authenticating proxy leaves them reachable but checks every HTTP request against a central login, with per-app access and a full audit trail. For web apps a well-configured proxy is enough; admin interfaces are worth both.
