My external NIC is configured with two separate IP addresses. I can run a website on one port of the alternate address and block everything else to that address. I use the primary address for letting the internal network see the outside world. The primary address is invisible to the world - incoming packets are all dropped unless they have an entry in the NAT table, i.e. originated on the inside.