I was building a tool to protect admin panels - close them off, give the team access through a gateway with a short token.

Along the way I gave the gateway its own DNS resolver, so it could reach servers with no public DNS record. Purely a side detail.