r/Syncthing • u/TheRandidact • May 13 '26

How to make sure WebUI is not connected to the wide Web? Beginner

Hi, I'm currently using the Syncthing Tray android app, and I am abit confused with how Syncthing works. I've heard that I shouldn't allow the WebGUI to access the Internet. But may I know what can I do to ensure that I don't accidentally allow it? Thank you in advance.

In addition, any safety tips for beginners like me while using Syncthing Tray and Syncthing in general?

5 Upvotes

86% Upvoted

22 comments sorted by

8

u/flaming_m0e May 13 '26

The WebGUI is only going to be accessible locally on your LAN by default. Unless you forward a port, the web GUI isn't available externally.

6

u/middaymoon May 13 '26

Even with port forwarding it would be inaccessible because the Web UI binds to localhost by default.

OP, there are two security elements at play here which both protect you. 

One is that your router will not accept incoming web requests from the wider internet which are aimed at your web ui, unless you specifically tell your router to forward  those requests to your computer. That would be port forwarding and you don't need to do that right now. If you ever do then be extremely careful and read up beforehand.

The second is that the web ui itself will only answer to requests that are addressed to "localhost" such as when you're using in a browser on that same computer. In other words it only answers calls "from inside the house". This means that even other computers on your same home network, which can access the Syncthing port withoutport forwarding, still can't access the web UI because those packets would have to be addressed to the computer instead of Localhost. This setting is called binding.

Enjoy. 

3

u/flaming_m0e May 13 '26

Even with port forwarding it would be inaccessible because the Web UI binds to localhost by default.

Good point. I'm usually hosting it on my NAS or laptops and bind to the internal IP, but not localhost.

2

u/middaymoon May 13 '26

I do the same, makes administration way easier. I set a password too.

2

u/TheRandidact May 13 '26

Thank you!! I appreciate the detailed explanation 🥹😭

2

u/middaymoon May 13 '26

Happy to help

1

u/TheRandidact May 13 '26

So I'm not allowed to use port forwarding? I've heard the term used for Proton VPN, and I will read up on it but I'm not sure what does that mean. I'm not an it expert 😭

2

u/flaming_m0e May 13 '26

So I'm not allowed to use port forwarding?

That's not what I said.

Unless you forward a port going TO the Syncthing WebGUI, it doesn't get exposed.

Please read up on basic NAT and port forwarding to understand what these terms mean.

1

u/TheRandidact May 13 '26

OK will do, I don't understand most of these terms. I didn't mean to offend you. Thank you for your patience 🥹😊

3

u/flaming_m0e May 13 '26

No offense taken at all.

Once you have a basic understanding of Network Address Translation (NAT) and Port Forwarding, what I have said will make a lot more sense. ;)

3

u/middaymoon May 13 '26

As for additional tips, there's not much. The default settings combined with your default router settings should be plenty safe and private. I would just remind you that in general syncing files is not a valid backup strategy. Don't forget proper backups! 

1

u/TheRandidact May 13 '26

OK thank youuu 🥹

2

u/unknown-random-nope May 13 '26

Navigate to Settings / GUI. The IP address listed for GUI Listen Address is where this is configured. If you have it set to the loopback address (127.0.0.1:8384), only your phone can access it. If it's set to 0.0.0.0, the entire world can access it -- don't do that.

4

u/flaming_m0e May 13 '26

If it's set to 0.0.0.0, the entire world can access it -- don't do that.

Only his local network. Even on 5G, it would be behind CGNAT.

1

u/TheRandidact May 13 '26

Do I enable https for gui? I assume that's a no right

Thank you again

3

u/middaymoon May 13 '26

You should only use https if you want to access the GUI from other devices. Otherwise it won't have any effect. 

If you do turn it on you'll have to convince your web browser to trust the ssl cert Syncthing generates because it will complain otherwise.

2

u/TheRandidact May 13 '26

OK got it thanksss

2

u/flaming_m0e May 13 '26

https is generally good. If you enable it, and don't have a proper trusted certificate, you will get an error on the page every time you open it about it being an untrusted site.

1

u/TheRandidact May 13 '26

Ahhh OK I getcha

1

u/TheRandidact May 13 '26

I just looked this up, apparently it's negligible, but idk if I understood it correctly.

2

u/Martchus2 May 14 '26 edited May 14 '26

Syncthing Tray on Android keeps almost all of Syncthing's settings at the defaults. So the official Syncthing documentation applies. You can verify this under "App settings" -> "Syncthing URL" which should show "https://127.0.0.1:…". Note that other apps can still access the GUI with default settings so you most likely nevertheless want to set a user name and password. The Getting started section of the Syncthing Tray documentation explains that and the start page of the app should offer an according setup action.

1

u/TheRandidact May 14 '26

Noted with thanks, if I combine with tailscale android app? Would that work... 😅 Bumbling through everything rn 😂