Heya Karnage, you could use a Cloudflare tunnel, and set up geo-ip restrictions, SSO, and 2FA for free… without opening a single port to the web.

Or you could use Tailscale.