Access Nextcloud From Outside the Office Safely VPN or Internet
The cloud works in the office. Now the owner wants it from home. This is the page to read before you touch the router.
By Technical AnshuLinux ServerSelf HostedSecurity
Watch the full video - Nextcloud and OnlyOffice setup and integration, step by step
Opening your Nextcloud to the internet is a security decision, not a network setting. This page compares the two honest routes - VPN-only access and properly hardened public access - and names the lazy middle path that is responsible for most real-world breaches of self-hosted clouds.
The two doors into your cloud - and what each one risks
Public internet, port forwardedCONVENIENT, EXPOSED
VPN only (WireGuard/Tailscale)PRIVATE, SAFER
Forwarding every port you findNEVER DO THIS
The server holds the office's real documents - the door matters as much as the lock.
Example access choices - the convenience and the exposure of each
1
The Honest Starting Point
The day the cloud works inside the office, someone asks for it from home. Understand what you are doing at that moment: you are publishing a login page, on the open internet, in front of your company's real documents. Attackers scan for exactly these pages continuously. This does not mean never do it - it means do it like it matters, because it does.
2
Route One - VPN Access, the Safer Default
With a VPN, Nextcloud never appears on the public internet at all. Staff connect the VPN (WireGuard is fast and simple; mesh tools like Tailscale make it easier still), and then open the same internal address they use at their desk. The attack surface shrinks to the VPN itself, which is built for exactly this job.
Best for: small teams, one office, phones and laptops of known people.
Cost: one extra connect step for users, and guests or clients cannot be sent simple public links that work - weigh that if client sharing is a big part of your use.
OnlyOffice follows automatically, since both servers are internal and reached the same way.
3
Route Two - Public Access, Done Properly
If the cloud must be public - client links, many locations, no VPN discipline possible - then harden it like a public service, because it is one:
HTTPS only, real certificates, on both subdomains - the reverse proxy is the only thing facing the internet.
Two-factor authentication enforced for every account, admin accounts first.
Updates on a schedule - an unpatched public Nextcloud is the actual risk, not the port itself.
Brute-force protection on (Nextcloud has it built in) and strong unique passwords via a password manager.
Never expose extras: the OnlyOffice example page stays disabled, database ports stay closed, and only 80/443 reach the proxy - every other forwarded port is an invitation.
4
The Choice, Plainly
For most small offices the answer is VPN first, and public access only for the specific sharing need that truly requires it. What you must not do is the middle path done lazily: a quick port-forward on a Friday, default settings, no 2FA, updates whenever. That specific combination is how self-hosted clouds get breached - not through exotic attacks, but through the open door nobody revisited.
Watch the Complete Video Guide
However you open access, the servers from the video sit behind it - watch the setup first, then choose your door with this page.
The forward itself is just a door. The risk is the combination behind it - no two-factor authentication, missed updates, weak passwords and test pages left enabled. A hardened, updated, 2FA-protected public Nextcloud is a reasonable setup; a forgotten default one is not.
Does OnlyOffice need its own public access too?
If Nextcloud is public, yes - the editor loads in the user's browser from the Docs server's own address, so that subdomain must be reachable the same way, over HTTPS. Under the VPN route both stay internal together and neither is published.
We only need it for two people from home. What is simplest?
A VPN. Two known people on known devices is the perfect VPN case: nothing is published, nothing new is exposed, and both servers keep working on their internal addresses. Tools like WireGuard or Tailscale make this an evening's work, not a project.
This guide is based on the Technical Anshu video on Nextcloud and OnlyOffice integration. Stuck on a step? Ask in the video comments - you will get an answer there.