I have a webapp that runs on a server on a local network. It needs to remain accessible to local traffic only, no external access via the wider internet. Users of the webapp will either be physically connected to the same network or tunneled in via VPN.