A method comprising: receiving (205, 305), at a gateway device, via a public network, and from a client device, a request to access a service provided by a host device in a private network, wherein the gateway device is in communication with the public network and in communication with the private network; transmitting (210, 310), from the gateway device to an authentication service, a request to authenticate the client device; receiving, at the gateway device from the authentication service, an indication that the client device has been authenticated; storing (225, 325), by the gateway device, a record comprising: an address of the client device, and an indication that the address of the client device has been authenticated; creating, at a gateway device, a port binding between: a first port for communicating with the service, the first port being opened (240, 325) for the client device to access the gateway device, and a second port for the gateway device to access the host device; transmitting, from the gateway device to the client device, a port number corresponding to the first port and an associated address of the gateway device for communicating with the service; and receiving, at the gateway device via the public network, on the first port, data to be transmitted to the host device, the data including an address of a device having sent the data; characterized in that: communications received at the first port from a device other than the client device are ignored by the gateway device; and the method further comprises, if the address of the device having sent the data corresponds to the address of the client device for which the first port is opened (240, 325): replacing (250, 335), by the gateway device, the address of the client device contained in the data with an address of the gateway device on the private network to produce transcoded data, and upon said replacing, transmitting the transcoded data from the gateway device to the host device. receiving (205, 305), at a gateway device, via a public network, and from a client device, a request to access a service provided by a host device in a private network, wherein the gateway device is in communication with the public network and in communication with the private network; transmitting (210, 310), from the gateway device to an authentication service, a request to authenticate the client device; receiving, at the gateway device from the authentication service, an indication that the client device has been authenticated; storing (225, 325), by the gateway device, a record comprising: an address of the client device, and an indication that the address of the client device has been authenticated; an address of the client device, and an indication that the address of the client device has been authenticated; creating, at a gateway device, a port binding between: a first port for communicating with the service, the first port being opened (240, 325) for the client device to access the gateway device, and a second port for the gateway device to access the host device; a first port for communicating with the service, the first port being opened (240, 325) for the client device to access the gateway device, and a second port for the gateway device to access the host device; transmitting, from the gateway device to the client device, a port number corresponding to the first port and an associated address of the gateway device for communicating with the service; and receiving, at the gateway device via the public network, on the first port, data to be transmitted to the host device, the data including an address of a device having sent the data; communications received at the first port from a device other than the client device are ignored by the gateway device; and the method further comprises, if the address of the device having sent the data corresponds to the address of the client device for which the first port is opened (240, 325): replacing (250, 335), by the gateway device, the address of the client device contained in the data with an address of the gateway device on the private network to produce transcoded data, and upon said replacing, transmitting the transcoded data from the gateway device to the host device. replacing (250, 335), by the gateway device, the address of the client device contained in the data with an address of the gateway device on the private network to produce transcoded data, and upon said replacing, transmitting the transcoded data from the gateway device to the host device.