/etc/apache2/sites-available/nextcloud.conf has

Require ip 127.0.0.1 172.18.96.1/255.255.224.0 192.168.0.0/255.255.255.0

to which must be added 10.8.0.0/255.255.255.0 (or we could ease the restriction)

(nextcloud config.php has '*' so it is already wide open)