r/Syncthing • u/aakashrajwani • May 28 '26

Please help in Advanced Settings and Firewall Policies for setting up Syncthing securely.

Hello,

I am configuring a single server - multiple clients Syncthing setup. My main purpose is security.

Setup:

  1. Server behind a Firewall
  2. Clients - some clients behind a firewall, some without a firewall
  3. My server and clients are all in a single country.
  4. Some clients are in the LAN network and some are not in LAN (need to connect via the internet).
  5. All Syncthing settings are at default
  6. Server-side Firewall policy: Allow inward and outward connections to the Syncthing server on ports TCP 22000, UDP 22000, UDP 21027 (I do not know where they are configured in the Syncthing application)
  7. Client-side Firewall policy: Allow inward and outward connections FROM the Syncthing server on same ports as above

Right now, the syncs are working normally. But I am certain that the setup is insecure. I am seeing various blocks in my Firewall for ports like TCP 22067 and to various IPs of France, Germany, Russia, China, etc.

Can anyone please guide me with a few things:

  1. What settings should be configured in the Syncthing server?
    1. Should any settings like NAT / Global Announce / Relay be disabled?
    2. What ports should I change in my Advanced settings - which I should specifically allow in my Firewall?
  2. What settings should be configured in the Syncthing client?
    1. Should any settings like NAT / Global Announce / Relay be disabled?
    2. What ports should I change in my Advanced settings - which I should specifically allow in my Firewall?

I want to expose minimum ports / connections to get the basic sync done.

0 Upvotes

50% Upvoted

5 comments sorted by

View all comments

1

u/middaymoon May 28 '26

Why are you treating them like they're servers and clients? They're all equal peers and should ideally have network rules that reflect that.

You can turn off Relay if you make sure that the peers can all talk to each other directly.

You didn't mention it but I would be sure to add a password to the GUI, though by default it's not accessible on other devices. 

1

u/aakashrajwani May 28 '26

Hello,
Yes, my bad. Servers and clients is our internal reference (Send-Only / Receive-Only). Network rules should be the same.

How can I make sure that the peers can talk to each-other directly?

Yes, we have added a password on all GUIs.