Restricting Nextcloud Access to WireGuard VPN (Behind Cloudflare)

​

Architecture

​

Why the Standard IP Whitelist Doesn’t Work

​

Solution

1. Teach Nginx to trust Cloudflare and restore real client IPs
2. Add proper allow/deny rules directly in the Nextcloud vHost config

​

Step 1 — Trust Cloudflare IPs in Nginx

echo "# Cloudflare Trusted IPs" | sudo tee /etc/nginx/conf.d/cloudflare.conf && \
curl -s https://www.cloudflare.com/ips-v4 | sed 's/^/set_real_ip_from /; s/$/;/' | sudo tee -a /etc/nginx/conf.d/cloudflare.conf && \
curl -s https://www.cloudflare.com/ips-v6 | sed 's/^/set_real_ip_from /; s/$/;/' | sudo tee -a /etc/nginx/conf.d/cloudflare.conf && \
echo "real_ip_header CF-Connecting-IP;" | sudo tee -a /etc/nginx/conf.d/cloudflare.conf

• Treat all Cloudflare IP ranges as trusted proxies
• Use the CF-Connecting-IP header as the real client IP

​

Step 2 — Add Access Control to the Nextcloud vHost

sudo nano /etc/nginx/sites-available/YOUR-NEXTCLOUD-SITE

# WireGuard subnet (direct VPN access)
allow 10.42.44.0/24;

# Localhost
allow 127.0.0.1;

# Server public IP (CRITICAL)
# VPN → Cloudflare → Server loopback makes requests appear from this IP
allow YOUR_SERVER_PUBLIC_IP;

# Block everyone else
deny all;

• 10.42.44.0/24 → your WireGuard subnet (check in wg-easy dashboard)
• YOUR_SERVER_PUBLIC_IP → your server’s public IP (e.g. 159.195.67.152)

Why allow the server’s own public IP? When a VPN user’s traffic routes through Cloudflare and loops back to the server, Nginx sees the server’s own public IP as the source. Allowing it here handles that case while still blocking all non-VPN internet traffic.

​

Step 3 — Apply the Changes

sudo nginx -t
sudo systemctl reload nginx

​

Result

• Nextcloud is only accessible to WireGuard-connected users
• Cloudflare proxy stays enabled (SSL, DDoS protection, etc.)
• No public internet access leaks through

​

Maintenance Notes

allow x.x.x.x;

​

Notes for ORIV Users

• The ORIV IP Management panel (Site → IP Management) is designed for external client IPs, not for VPN-based access control. For WireGuard restrictions, Nginx-level configuration (as described above) is the correct approach.
• ORIV sites run on Nginx — the config file is located at /etc/nginx/sites-available/your-site-name.
• After editing Nginx config files on an ORIV server, always run sudo nginx -t before reloading to catch any syntax errors.