You set up Nextcloud on an old mini-PC in the basement. Works beautifully. Phone photos sync, calendar, contacts, 200 GB of family documents. Computer at home - flies. Phone on home Wi-Fi - works. You configure the mobile app, the desktop client, everything green.
The next day you fly out for a conference. The hotel offers "free Wi-Fi". You open the laptop, you want to grab the deck you uploaded yesterday to Nextcloud. Desktop client says "connection failed". Mobile app - same. WireGuard back to home - won't connect. You check the router IP in the panel - 100.74.x.x. CGNAT at the hotel ISP, and CGNAT at your home ISP too. You will not download that deck today, and you will not download it tomorrow. Result: 3 hours on Saturday before the conference with a missing presentation.
Why Nextcloud is harder to expose than HA#
Exposing Home Assistant is one thing: a single HTTP port, login screen, sometimes a WebSocket for integrations. Attackers get three vectors: login brute-force, custom-integration exploits, known core CVEs. Unpleasant but bounded.
Nextcloud is a platform. Behind one address sits WebDAV (file sync), CalDAV/CardDAV (calendar, contacts), Talk (WebRTC, video), Office (collaborative editing), Mail, Notes, Deck, Photos, plus dozens of app-store add-ons. Each layer has its own endpoint, its own CVE history, its own permission logic.
It requires HTTPS from day one. Modern browsers block drag-and-drop file uploads over plain HTTP. The desktop client also requires TLS. Plain HTTP = the client never connects.
It is a popular target. Shodan bots scan for /remote.php/webdav 24/7. The moment you publish port 443 with Nextcloud, you get the first login attempts within 6 hours. Not "someday" - within a day.
Synology and QNAP have their own apps (DSM File Station, QSync) - convenient, but closed, no 200 add-ons, no Talk, no federation. Self-hosted Nextcloud gives you everything, provided you expose it safely.
Never expose Nextcloud without 2FA. Day-one production = day-one brute-force. Without a second factor the password Summer2024! survives 11 hours.
4 ways to remote-access Nextcloud - brutal ranking#
Each of these methods is correct under specific conditions. The problem is that the internet rarely tells you which conditions.
1. Port forwarding + DynDNS#
How it works: open port 443 (behind a reverse proxy) on your router. A domain like cloud.duckdns.org points to your public IP, a DynDNS client updates the record on change. Let's Encrypt issues the cert. Nextcloud is visible from every internet on Earth - including the 50 million bots on it.
When it makes sense: you have a public IPv4 (check first - most mobile carriers don't give you one, more on CGNAT in the HA pillar), you can configure Nginx + LE renew, you run fail2ban, you watch auth.log, you patch Nextcloud monthly, you only expose 443 (not the admin panel), you have 2FA, GeoIP block and a WAF.
Why almost no hobbyist meets these conditions: because nobody has fail2ban properly tuned for /login, nobody restricts /remote.php/dav by source IP. "Works" for 4 months. Then a CVE drops in the Mail app, somebody plants a library through a WebDAV upload, you come back from holiday and find your documents on an onion marketplace.
Verdict: trap for 99%. For the 1% whose day job is IT, possible - still wouldn't recommend.
2. VPN (WireGuard / OpenVPN)#
How it works: stand up WG on the router or in a separate container next to Nextcloud. Each client (your laptop, your spouse's phone, your in-laws') installs the WG app, imports the config. They connect as if they were home, Nextcloud is visible at its LAN address.
Pros: strong encryption, zero Nextcloud exposure to the public internet, access to other services too (NAS, printer).
Cons:
- An app on every household device. Your spouse fires up WireGuard before opening last weekend's photos? Good luck.
- Public share links break. You sent a friend
cloud/s/xyz123? They don't have WG, they don't download. - Doesn't work behind CGNAT. Your router behind CGNAT = WG server not reachable from outside. Closed circle.
- Mobile Nextcloud clients don't always handle VPN drops gracefully - sync hangs, requires a manual restart.
Verdict: good for a solo developer. Weak for families. Pointless behind CGNAT.
3. Cloudflare Tunnel#
How it works: install cloudflared on the Nextcloud host. It opens an outbound connection to Cloudflare. In the CF dashboard you map cloud.yourdomain.com → tunnel. HTTPS automatic.
Pros: free, works behind CGNAT, your own domain, DDoS protection.
Cons the docs don't print loudly:
- Cloudflare ToS prohibits excessive file traffic through the free tier (section 2.8). Nextcloud syncing 200 GB of family photos is the textbook case for enforcement. Some get banned after a month, some after a year, some never. Lottery.
- 100 MB upload limit per HTTP request through Cloudflare on the free plan. Trying to sync a 4K vacation video? Blocked.
- Video streaming from Nextcloud (gallery, movie playback) - same ToS limit as Jellyfin.
- The WAF sometimes blocks legitimate Nextcloud requests - debugging it is "why did sync die at 3:42 AM" the game.
Verdict: free, but Cloudflare ToS turns it into Russian roulette for file storage. Wider comparison here.
4. Reverse SSH tunnel (e.g. SmartHomeEntry)#
How it works: an agent on the Nextcloud host opens an outbound SSH tunnel to a relay server. The relay exposes your Nextcloud at a stable HTTPS subdomain like cloud.smarthomeentry.com. Zero ports on your side. No router config.
Pros:
- Works behind CGNAT (outbound tunnel, doesn't matter where you are).
- Stable HTTPS subdomain, automatic wildcard Let's Encrypt at the relay.
- No ToS storage limits (unlike CF).
- Family-friendly - link in the browser, mobile and desktop clients work out of the box.
- Multi-service - one machine can serve Nextcloud + Home Assistant + Jellyfin + NAS. Each runs its own agent with its own tunnel and subdomain, and your plan sets how many you get.
Cons:
- Dependency on the relay. If managed (from EUR 7/mo hobby plan), your external access = their uptime. Locally Nextcloud keeps running independently.
- Paid for managed - from EUR 7/mo for hobby, from EUR 23/mo for B2B with custom domain.
Verdict: for most Nextcloud users outside a single-user-with-public-IP setup - best balance of security/comfort/setup time. Below I'll show why - in 60 seconds.
| Method | Works behind CGNAT | Setup | Family-friendly | Storage limits | HTTPS |
|---|---|---|---|---|---|
| Port forwarding | no | hard | yes | none | manual |
| WireGuard | no | medium | no | none | n/a |
| Cloudflare Tunnel | yes | medium | yes | ToS limits | auto |
| Reverse SSH | yes | 60 sec | yes | none | auto |
Nextcloud + SSH tunnel setup in 60 seconds#
I assume you already have Nextcloud running locally at something like http://192.168.1.50 or http://nextcloud.local. If not - installation pillar first at /nextcloud.
-
Create a SmartHomeEntry account, pick a subdomain (e.g.
mycloud.smarthomeentry.com). On signup we bind it to your tunnel in the DB and allocate a unique relay port. -
Set Nextcloud's local address in the dashboard ("Local address" field in onboarding). This is the address Nextcloud listens on inside your network - the agent forwards tunnel traffic there. Nextcloud usually runs on port 80 (or 443, or a custom port in Docker), not 8080. If you are not sure, check on the Nextcloud host:
sudo ss -tlnp | grep -E ':(80|443|8080|8081|9000)\b'Enter e.g.
localhost:80. This address is baked into the install command from the next step. -
Grab the install command from the dashboard and paste it into a terminal on the Nextcloud host:
curl -sSL https://api.smarthomeentry.com/api/install/YOUR_TOKEN | sudo bashThe script installs the agent as a systemd service, pulls the SSH key via a one-time install token (15 min TTL), writes the local address to
/etc/smarthomeentry/agent.envand opens the tunnel to the relay. -
Add the subdomain to
trusted_domainsin Nextcloud'sconfig/config.php(typically/var/www/nextcloud/config/config.phpor/var/snap/nextcloud/current/nextcloud/config/config.php):'trusted_domains' => array ( 0 => 'localhost', 1 => '192.168.1.50', 2 => 'mycloud.smarthomeentry.com', ), -
Set
overwrite.cli.urlandoverwriteprotocolso Nextcloud generates correct URLs (file links, share, OAuth callback):'overwrite.cli.url' => 'https://mycloud.smarthomeentry.com', 'overwriteprotocol' => 'https', 'overwritehost' => 'mycloud.smarthomeentry.com', -
Restart Nextcloud / reload the web server (
systemctl reload apache2orsystemctl reload nginxdepending on your stack) and openhttps://mycloud.smarthomeentry.com. You should see the Nextcloud login screen over HTTPS - no cert warnings, no router config, no port opening.
If on first open Nextcloud returns "Access through untrusted domain", you didn't save config.php or didn't reload PHP-FPM. After changing trusted_domains reload the whole stack, not just occ.
Subdomain returns 502? The tunnel is up, but the agent is forwarding to a local address where nothing listens - usually the default Domoticz port instead of the Nextcloud one. Check and fix it without reinstalling the agent:
grep LOCAL_ADDR /etc/smarthomeentry/agent.env
sudo sed -i 's|^SMARTHOMEENTRY_LOCAL_ADDR=.*|SMARTHOMEENTRY_LOCAL_ADDR=localhost:80|' /etc/smarthomeentry/agent.env
sudo systemctl restart smarthomeentry-agent
If the agent runs in Docker (macOS, or no .deb/.rpm build for your architecture), there is no agent.env - the address is baked into the container. In that case fix the local address in the dashboard, remove the container and run the install command again:
docker rm -f smarthomeentry-agent
What's next - best practices after setup#
The tunnel works, you have HTTPS, you can pull files from hotel Wi-Fi. Now 5 minutes of hygiene - so you don't have to come back to this in 6 months.
- Enable 2FA TOTP (Settings → Security → Two-Factor Authentication). Authy / Aegis. Without it the first bot that guesses the password takes everything.
- Disable the default admin and create a separate admin account with a strong password (16+ chars, generator). Your daily-driver account should be a regular user.
- Enable brute-force protection - on by default; check
bruteforce.protection.enabledistrueinconfig.php. After 10 failed logins it blocks the IP for 24 h. - Update to latest stable - Nextcloud ships a quarterly major and a monthly security patch.
occ upgradefrom cron or from the dashboard. Old version on a public tunnel = problem of when, not if. - End-to-end encryption for sensitive folders - Nextcloud E2EE encrypts files with the client key, the server only sees ciphertext. Slows sync down, but for taxes/legal it's worth it.
- Backup is on you - the relay only forwards traffic. Backups of
data/+ DB dump +config.phpare your responsibility. Borg / Restic to a separate storage.
Also set log_level => 2 (warning) in production, not 0 (debug). Nextcloud logs grow fast and debug eats the disk in a week.
FAQ#
| Question | Answer |
|---|---|
| Does Nextcloud Talk (video, audio) work through the tunnel? | Yes. WebRTC over HTTPS is tunneled by the relay. Latency depends on relay location (relay in Warsaw + EU user = ~50-120 ms). For 1-on-1 calls it's smooth; for 10+ participants consider a TURN server. |
| Do desktop / mobile clients sync over the subdomain? | Yes. Enter https://mycloud.smarthomeentry.com as the server address, log in normally. Sync, share, push notifications - all work identically to a direct address. |
| Can I use my own domain instead of a subdomain? | Yes, on the B2B / Pro plan. CNAME nextcloud.yourdomain.com to our relay, we issue an LE cert for your domain. Hobby plan = *.smarthomeentry.com subdomains. |
| What about backups for my files? | Your Nextcloud, your files, your backup. The relay stores no data, only forwards traffic. Recommend Borg / Restic to offsite + ZFS snapshots if you have a NAS. |
| Does WebDAV (mounting as a network drive) work? | Yes. WebDAV URL is https://mycloud.smarthomeentry.com/remote.php/dav/files/USERNAME/. Mount via Windows Explorer, macOS Finder, GNOME Files, rclone. |
| Can I tunnel other services from the same host? | Yes. One agent handles many subdomains - cloud.smarthomeentry.com → Nextcloud, media.smarthomeentry.com → Jellyfin, ha.smarthomeentry.com → Home Assistant. |
Verdict#
Reverse SSH tunnel is the best Nextcloud choice if: you're behind CGNAT (mobile ISP, parts of fibre), you have a family using the cloud, you want to add other services (Jellyfin, HA), or you simply don't want to spend Saturday afternoons configuring Nginx + fail2ban + Let's Encrypt + WAF.
Alternative? If you're solo, you have a public IPv4, you watch logs and you enjoy 2018-vintage Nginx panels - port forwarding will work and I won't pay you anything. WireGuard also makes sense when you don't share public links. Cloudflare Tunnel - if you accept the storage-ToS lottery. For most of the rest - Nextcloud + SmartHomeEntry - link in the browser, works everywhere, 60-second setup. This is also the path we recommend to B2B installers serving many clients.
