All you need to do is get yourself a proxy server, and configure it to force authentication fro users requiring web access, but yet, it does require another box. Unfortunately...

Is there a reason you are trying to do this?