SYNCTHING-NETWORKING(7)

💅 syncthing-networking — bestie's guide to firewall setup ✨

Okay so this is the syncthing-networking(7) page from the Syncthing manual, and it's literally all about firewalls and routers and getting your devices to actually talk to each other. Buckle up, because we're gonna make your network slay 💖

---

🌸 NAME 🌸

syncthing-networking — Firewall Setup. That's it, that's the vibe 🎀

---

🦋 ROUTER SETUP 🦋

✨ Port Forwards ✨

So if you have a NAT router that supports UPnP, the easiest way to get a working port forward is: make sure the UPnP setting is enabled on both Syncthing and the router — Syncthing will try to handle the rest for you 🫶

If it succeeds, you'll see a message in the console saying:

Created UPnP port mapping for external port XXXXX on UPnP device YYYYY.

If that's not possible or not something you want (no cap, valid), then you should set up a port forwarding for ports 22000/TCP and 22000/UDP (or whichever port is set in the Sync Protocol Listen Address setting). Heads up: the external forwarded ports and the internal destination ports have to be the same (e.g. 22000/TCP) 👑

Communication in Syncthing works both ways. So like, if you set up port forwards for one device, other devices will be able to connect to it even when they're behind a NAT network or firewall. Main character energy fr fr 🔥

In the absence of port forwarding, Relaying may work well enough to get devices connected and synced, but ngl it will perform poorly in comparison to a direct connection 😭

🌈 Local Discovery 🌈

Your router needs to allow/forward broad-/multicasts for local discovery to work. Usually these are allowed by default in a single local subnet, but they may be blocked between different subnets or even between a bridged Wi-Fi and LAN 💀

If you're unable to set up your router thus — or your firewall as shown below — and your devices have static IP addresses, you can specify them directly by changing the default dynamic setting for Addresses to something like:

tcp://192.168.1.xxx:22000, dynamic

---

🔥 LOCAL FIREWALL 🔥

If your PC has a local firewall, you will need to open the following ports for incoming and outgoing traffic:

• Port 22000/TCP: TCP based sync protocol traffic
• Port 22000/UDP: QUIC based sync protocol traffic
• Port 21027/UDP: for discovery broadcasts on IPv4 and multicasts on IPv6

If you configured a custom port in the Sync Protocol Listen Address setting, you have to adapt the firewall rules accordingly. No skipping that step bestie 🙈

🎀 Uncomplicated Firewall (ufw) 🎀

If you're using ufw on Linux and have installed the Syncthing package <https://apt.syncthing.net/>, you can allow the necessary ports by running:

sudo ufw allow syncthing

If you also want to allow external access to the Syncthing web GUI, run:

sudo ufw allow syncthing-gui

Allowing external access is not necessary for a typical installation. Like, it's giving "optional side quest" 💅

You can then verify that the ports mentioned above are allowed:

sudo ufw status verbose

In case you installed Syncthing manually, you can follow the instructions to manually add the syncthing preset <https://github.com/syncthing/syncthing/tree/main/etc/firewall-ufw> to ufw 🐝

⭐ Firewalld ⭐

If you are using Firewalld <https://firewalld.org/>, it has included support for syncthing (since version 0.5.0, January 2018 — vintage icon behavior honestly), and you can enable it with:

sudo firewall-cmd --zone=public --add-service=syncthing --permanent
sudo firewall-cmd --reload

Similarly there is also a syncthing-gui service. Obsessed with the consistency 💜

---

👑 REMOTE WEB GUI 👑

To be able to access the web GUI from other computers, you need to change the GUI Listen Address setting from the default 127.0.0.1:8384 to 0.0.0.0:8384. You also need to open the port in your local firewall if you have one 🔓

🌸 Tunneling via SSH 🌸

If you have SSH access to the machine running Syncthing but would rather not open the web GUI port to the outside world, you can access it through a SSH tunnel instead. You can start a tunnel with a command like the following:

ssh -L 9999:localhost:8384 machine

This will bind to your local port 9999 and forward all connections from there to port 8384 on the target machine. And the iconic part? This still works even if Syncthing is bound to listen on localhost only 😌✨

---

🧚 VIA A PROXY 🧚

Syncthing can use a SOCKS5 proxy for outbound connections. Please see Using Proxies 🫶

---

💖 AUTHOR 💖

The Syncthing Authors — legends, honestly 👑

---

🌟 COPYRIGHT 🌟

2014-2026, The Syncthing Authors 🎀

---

Okay that's the whole page bestie, go forth and port-forward responsibly 💅🌸

signing off — this was version v2.1.0, dated Oct 07, 2026, love u, bye 🦋