Syncthing Remote Access How Devices Connect Over the Internet With No Open Ports
People expect remote sync to need router settings and a static IP. Syncthing needs none of it. This guide explains the three ways your devices find each other across the internet — and what each one can and cannot see.
✍️ Technical Anshu🌍 Works behind normal home routers⏱️ Explainer, no configuration needed
🎥 The main Syncthing video shows devices syncing — this guide explains what happens when they leave the same network
At home, Syncthing is simple to picture: laptop and hub on the same Wi-Fi, talking directly at full LAN speed. Then you take the laptop to a client's office in another city, open it — and the files still sync. No port was forwarded. No static IP was bought. No VPN was connected. It feels like magic until you know the three mechanisms underneath, and each has an honest trade-off worth understanding, because one of them involves other people's servers passing your traffic along.
How a travelling laptop reaches the home hub — three honest routes
ROUTE 1 Direct connection ......... best
Devices find each other, punch through NAT,
talk directly. Full speed. Nobody in between.
ROUTE 2 Local discovery (same LAN) . at home
Devices announce themselves on the network.
Fastest path, nothing leaves the building.
ROUTE 3 Relay ...................... fallback
A volunteer relay passes the traffic when a
direct path is impossible. Still TLS encrypted
end to end — the relay reads NOTHING, it only
forwards scrambled data. Slower, but it works.
Illustrative panel — Syncthing tries these in order, automatically
1
Discovery — How Devices Learn Where to Shout
Two paired devices cannot sync until they know each other's current address, and home addresses change. Syncthing solves this with global discovery servers: each device periodically announces "Device ID PBIKQTO… is reachable at this address". When your laptop wants the hub, it asks discovery "where is PBIKQTO… right now?"
The discovery server learns addresses, not files. It never sees a single byte of your data.
It can only answer questions about a Device ID — and IDs are long random fingerprints, so nobody can enumerate strangers.
On the same network, local discovery (a broadcast on your LAN) does the same job without the internet at all.
If you disable global discovery in settings, remote sync stops working unless you hard-code addresses. Leave it on unless you run a fully private setup and know why.
2
Direct Connections and NAT — Why It Usually Just Works
Home routers hide every device behind one public address (NAT), which normally blocks incoming connections. Syncthing uses well-known techniques — the same family as video calls — to establish direct paths through this: both devices coordinate through discovery, and most home routers allow the resulting connection through. UPnP on the router can also open a temporary mapping for Syncthing automatically.
When a direct path succeeds, sync is as fast as the two internet connections allow — the office upload speed is usually the ceiling.
Some networks defeat direct paths: strict office firewalls, double NAT from chained routers, and mobile carriers with aggressive NAT. That is what relays exist for.
3
Relays — the Fallback, Stated Plainly
If no direct path is possible, Syncthing can route the connection through a relay — a server run by a community volunteer that simply forwards the encrypted stream between your two devices.
What the relay sees: two device IDs, timing, and a flow of TLS-encrypted bytes. It cannot decrypt them; the encryption keys never leave your devices. A relay is a corridor, not a copy room.
What it costs you: speed. Relayed sync is noticeably slower than direct, which is why Syncthing only falls back to it when needed and shows "Relay" in the connection type when it does.
The trust question, answered honestly: you are trusting mathematics, not the volunteer. The same encryption that protects the direct path protects the relayed one, because it is end to end in both cases.
You can disable relays in settings if your policy demands it — and accept that some locations will then simply not sync until the device comes home.
4
Practical Expectations for Remote Sync
A few honest consequences for daily use:
Big files over the internet take internet time. A 2 GB video moves at your home upload speed, not LAN speed. Let the first sync of anything big happen at home; remote is for the daily changes.
CGNAT homes still work, usually via relay or a successful direct path — this is one of Syncthing's real advantages over old-style port-forwarded servers, which CGNAT breaks completely.
The web interface is not part of this. Remote sync does not expose the hub's http://localhost:8384 admin page to the internet, and you should never forward it manually. Sync traffic and admin traffic are different doors; only one of them opens outward, and it demands a paired Device ID.
🔴 The security summary in one breath: discovery servers learn addresses, relays forward ciphertext, and only devices whose IDs you personally accepted can ever connect. No open ports on your router, no account to phish, no admin page facing the internet. That is a smaller attack surface than most cloud drives offer.
🎥 Watch the Devices Sync in the Video
The main Syncthing setup video pairs the hub, laptop and phone and syncs real folders — the foundation this guide builds on.
No. Discovery exists precisely because home IPs change. Your devices announce their current addresses to the discovery service and find each other by Device ID, so a dynamic IP, and even most CGNAT connections, work without buying anything from your ISP.
Is Syncthing traffic visible to my office or ISP?
They can see that encrypted traffic flows between two endpoints, and roughly how much. They cannot see file names or contents — everything is TLS encrypted between your paired devices, on direct and relayed paths alike.
Why is remote sync sometimes slow even on fast internet?
Three usual reasons: the home hub's upload speed is the bottleneck, the connection fell back to a relay because a direct path failed, or one device is on a weak Wi-Fi far from its router. The interface shows the connection type for each device, which tells you which explanation applies.
This guide is part of the Syncthing series by Technical Anshu • Watch the main setup video for the full live build 🙏