SYNCTHING-NETWORKING(7)            Syncthing           SYNCTHING-NETWORKING(7)



NNAAMMEE
       syncthing-networking - Firewall Setup

RROOUUTTEERR SSEETTUUPP
   PPoorrtt FFoorrwwaarrddss
       If  you have a NAT router which supports UPnP, the easiest way to get a
       working port forward is to make sure UPnP setting is  enabled  on  both
       Syncthing and the router â Syncthing will try to handle the rest. If it
       succeeds you will see a message in the console saying:

          Created UPnP port mapping for external port XXXXX on UPnP device YYYYY.

       If this is not possible or desirable, you should set up a port forward‐
       ing  for ports 2222000000//TTCCPP and 2222000000//UUDDPP (or whichever port is set in the
       _S_y_n_c _P_r_o_t_o_c_o_l _L_i_s_t_e_n _A_d_d_r_e_s_s setting).  The  external  forwarded  ports
       and   the  internal  destination  ports  have  to  be  the  same  (e.g.
       22000/TCP).

       Communication in Syncthing works both ways. Therefore  if  you  set  up
       port  forwards for one device, other devices will be able to connect to
       it even when they are behind a NAT network or firewall.

       In the absence of port forwarding, relaying may work well enough to get
       devices  connected and synced, but will perform poorly in comparison to
       a direct connection.

   LLooccaall DDiissccoovveerryy
       The router needs to allow/forward broad-/multicasts for local discovery
       to  work.   Usually these are allowed by default in a single local sub‐
       net, but may be blocked between different subnets  or  even  between  a
       bridged Wi-Fi and LAN.

       If  you are unable to set up your router thus or your firewall as shown
       below, and your devices have static IP addresses, you can specify  them
       directly by changing the default ddyynnaammiicc setting for _A_d_d_r_e_s_s_e_s to some‐
       thing like: ttccpp::////119922..116688..11..xxxxxx::2222000000,, ddyynnaammiicc.

LLOOCCAALL FFIIRREEWWAALLLL
       If your PC has a local firewall, you will need to  open  the  following
       ports for incoming and outgoing traffic:

       · Port 2222000000//TTCCPP: TCP based sync protocol traffic

       · Port 2222000000//UUDDPP: QUIC based sync protocol traffic

       · Port  2211002277//UUDDPP:  for  discovery broadcasts on IPv4 and multicasts on
         IPv6

       If you configured a custom port in the  _S_y_n_c  _P_r_o_t_o_c_o_l  _L_i_s_t_e_n  _A_d_d_r_e_s_s
       setting, you have to adapt the firewall rules accordingly.

   UUnnccoommpplliiccaatteedd FFiirreewwaallll ((uuffww))
       If  youâre  using uuffww on Linux and have installed the _S_y_n_c_t_h_i_n_g _p_a_c_k_a_g_e
       <hhttttppss::////aapptt..ssyynncctthhiinngg..nneett//>, you can allow the necessary ports by run‐
       ning:

          sudo ufw allow syncthing

       If  you  also  want  to allow external access to the Syncthing web GUI,
       run:

          sudo ufw allow syncthing-gui

       Allowing external access is nnoott  necessary for a typical installation.

       You can then verify that the ports mentioned above are allowed:

          sudo ufw status verbose

       In  case  you  installed  Syncthing  manually  you   can   follow   the
       _i_n_s_t_r_u_c_t_i_o_n_s     _t_o     _m_a_n_u_a_l_l_y     _a_d_d     _t_h_e    _s_y_n_c_t_h_i_n_g    _p_r_e_s_e_t
       <hhttttppss::////ggiitthhuubb..ccoomm//ssyynncctthhiinngg//ssyynncctthhiinngg//ttrreeee//mmaaiinn//eettcc//ffiirreewwaallll--uuffww>  to
       ufw.

   FFiirreewwaalllldd
       If  you  are  using  _F_i_r_e_w_a_l_l_d <hhttttppss::////ffiirreewwaalllldd..oorrgg//> it has included
       support for syncthing (since version 0.5.0, January 2018), and you  can
       enable it with:

          sudo firewall-cmd --zone=public --add-service=syncthing --permanent
          sudo firewall-cmd --reload

       Similarly there is also a ssyynncctthhiinngg--gguuii service.

RREEMMOOTTEE WWEEBB GGUUII
       To  be  able  to  access  the web GUI from other computers, you need to
       change the _G_U_I _L_i_s_t_e_n _A_d_d_r_e_s_s setting from the  default  112277..00..00..11::88338844
       to  00..00..00..00::88338844. You also need to open the port in your local firewall
       if you have one.

   TTuunnnneelliinngg vviiaa SSSSHH
       If you have SSH access to  the  machine  running  Syncthing  but  would
       rather  not  open the web GUI port to the outside world, you can access
       it through a SSH tunnel instead. You can start a tunnel with a  command
       like the following:

          ssh -L 9999:localhost:8384 machine

       This will bind to your local port 9999 and forward all connections from
       there to port 8384 on the target machine.  This  still  works  even  if
       Syncthing is bound to listen on localhost only.

VVIIAA AA PPRROOXXYY
       Syncthing  can  use a SOCKS5 proxy for outbound connections. Please see
       proxying.

AAUUTTHHOORR
       The Syncthing Authors

CCOOPPYYRRIIGGHHTT
       2014-2019, The Syncthing Authors



v1.19.2                          Apr 05, 2022          SYNCTHING-NETWORKING(7)
