You can configure it to have access rules including a log in. What it really accomplishes is not exposing the IP address of the host machine and dealing with CNAT or dynamic IP.