A hidden pathway to a host is provided in an internetwork having an egress router coupled to the host. A selected port of the egress router is connected to the host as a hidden access port. A label table in the egress router is configured to associate the selected port with a predetermined label. Distribution of the predetermined label is restricted to one or more controlled access points so that access to the hidden pathway is restricted to the controlled access points. The controlled access points may reside at the users themselves, but are preferably contained within proxy devices coupled to the internetwork using secure connections.