I need to expose via Internet an insecure internal web app that can't be modified to be made intrinsically more secure. The most common solution for this problem is to access the web app through VPN. Unfortunately, this isn't possible in my situation so I'm left scrambling for another solution.
At some point I've experienced working with firewalls that could dynamically open ports after users passed authentication through a web form. The form was on a website served by the firewall device and, behind the scenes, the firewall was using the credentials provided through the form to authenticate against Active Directory. After the auth passed, for a limited time the firewall opened some ports for the IP from which the web form connection originated.
I would like to use something like this in my scenario as it would provide sufficient security for my web app. Unfortunately I don't know the tech. stack to look for or the well-established names for this kind of firewall auth.
Can someone enlighten me on which technologies I need to look at?