hi @lordy we had similar discussions in the past, please use search e.g. Restrict Nextcloud over VPN except Talk
IMHO this will not work as you still block scripts, CSS and other elements required for basic functionality. I would recommend you follow basic security guidelines How to maintain, check and improve the security of your Nextcloud installation and your system will be safe enough to keep script kiddies away…