I think there is at least one instance that detects a “Symmetric NAT” setup, and the remote does try to connect to the external interface of the router. So forwarding would be needed indeed.
I’ll look more carefully at it.
In the mean time I thought I’d try to describe my use case. Sorry it is a bit verbose. HTH.
On each site:
IPv4, no UPnP on GWs. GWs defined as “DMZ hosts” in their respective “Edge” ISP Box.
Some holes are poked in the GW on each site to allow subnet 1 and subnet 2 to interact on a limited set of services.
Syncthing must be one of these: at least the S1 laptop replicates data served by Syncthing instance S3. S3 is a server, it doesn’t move.
Ideally, S1 and S2 can share stuff and S2 can also replicate with S3.
Each “S3” Syncthing instance must replicate with the other one.
S1 and S2 are laptops, their Syncthing service should continue working when they are outside their usual site.
- S3 has Global discovery enabled, nothing else.
- S1, S2 ideally should have default configs.
- If initial discovery doesn’t work between S3 and S1 (or S2), that’s ok as long as a simple address name can be used (e.g. tcp://sync/) and details figured out by the site’s GW.