I’d wish to clarify what may not be so obvious, still.
The 0.0.0.0 address will effectively make the server software (Syncthing, in this case) bind its server port to all interfaces. Basically; any physical path into the machine.
So, that sounds alarming, no?
No! Absolutely not. Because most consumer devices are likely sitting behind a router (or call it a “forward proxy”, as opposed to the “reverse proxy” commonly found sitting in front of servers).
The router has a public IP, yes, but the devices behind the router (e.g. your computer, a couple of phones, maybe even a fridge these days lol) do not. Had that been the case, given the large number of devices we have, internet would’ve crashed a long time ago because of an insufficient amount of available public addresses (as it pertains to IPv4).
Hence, only the router has a public address, and the router will through magic port mapping forward traffic it receives to the intended [but not public] device behind it.
For example. Suppose a web browser wants to retrieve a web page. The browser sends out some packages or whatever, which goes through the router. The packages sent from the computer has a local source address which is not public (i.e. it’s local, router-internal, private IP).
But before forwarding these packages out into the great unknown internet, the router hacks the source address to become its own public IP in combination with a unique port which is designated for the sending device in question.
The router will internally keep a routing table (hence the name, I think), such that it knows “hey when I get traffic coming back destined for my public IP and such and such magic port that I reserved, then I know to forward the traffic to device X”.
Server software (again, Syncthing in this case!), unlike a client’s outbound connection (implicitly), does not in any shape or form preannounce to the router its willingness to connect to and talk with the outer world. And so normally, the server will just sit there patiently awaiting new client connections which never arrives, because it’s just not reachable; should incoming client connection requests hit a particular port blah blah on the router which the router does not know about it will simply discard them.
In the old world, what one had to do was to manually go and configure the router like “hey, when traffic comes in on port blah blah, please forward this to device X port Y”, and voila, the server software is now reachable.
In today’s world, we have certain methods to try to make that configuration happen automagically, which is what is meant by “NAT traversal”.
In conclusion; if global discovery, relay servers, NAT traversal, and version updates are all turned off, then Syncthing should in theory only be running on the local network.
Now I say in “theory”, because I noticed through monitoring my network that Syncthing was still trynna’ reach public servers to query what new software versions may be available. I cannot explain that one, given how I disabled automagic version updates in Syncthing.
Suffice it to say that my firewall is blocking all traffic that I do not explicitly approve lol, and this is just one example of how important such firewall configuration is! All software is inherently unreliable.
