One option typically used by organizations to forward a plaintext TCP connection over the network is SSH local and remote port forwarding. SSH binds a port locally and forwards all traffic to the remote machine over SSH.
This is a great solution for a number of reasons, namely that you get message encryption and message authenticity, and you also have somewhat of a guarantee of authorization in that the user must have SSH access to the machine (and root if the port is under 1024).
However, in the case of wanting message encryption and authenticity without wanting authentication per se, I'm not sure of another existing solution off-hand.
What I was able to imagine, however is a server/agent setup which would wrap TLS and do port forwarding where needed. Say that I need to run Redis over the internet (why is beyond the point, if you're asking why, ask for another service that would best fit your imagination). A decent solution would be to run a process on the Redis server which bound to a given port and acted as a TLS proxy. You'd need to run through an entire TLS handshake to connect and transfer data to this proxy.
The second half of the equation would be to run something client-side on the servers which need to connect to Redis. This would again listen on a local port, but forward traffic over TLS to the aforementioned TLS proxy.
Does such a technology exist? I'd like the eventual option of using client-side SSL certificates for authentication, but simply upgrading to TLS over plaintext is a huge benefit in my opinion.