Cloudflare Access does that. I suspect other SASE/zero trust solutions probably also do (iirc it does everything you've named)