I’ve got a reverse proxy for stuff I want to be able to hit from the outside. It’s behind an SSO portal with 2fa (hardware token). Then for everything else I VPN in.