port forwarding documentation

[dinosore (David Rimmer)]

Looking at port forwarding in the documentation I see

If this is not possible or desirable you should set up a port forward for port 22000/TCP, or the port set in the Sync Protocol Listen Address setting. The external forwarded port and the internal destination port has to be the same (i.e. 22000/TCP).

Communication in Syncthing works both ways. Therefore if you set up port forwards for one device, other devices will be able to connect to it even when they are behind a NAT network or firewall.

having a couple of minor quibbles about the 2nd sentence in the 1st paragraph, I see I don’t understand it fully.

Presumably this doesn’t apply if you use port address translation (PAT)?

Then there’s the 2nd paragraph.

I have dynamic dns to my house (local.example.com) and at my son’s house (remote.example.com) with port 22000 forwarded to a pi at each end.

Upload at my end is low-speed, and so the remote pi connects only to the local pi. So far, so good, and it all works well.

However, thinking that I might try connecting my laptop to the remote pi to see if that worked better, I can’t see a way to connect without forwarding another port to my laptop. I can see why I don’t need another port forward at the local end.

I am taking the phrase “other devices will be able to connect to it” to imply that they will be able to establish two-way communication. I can’t see how this would work, so I suspect the implication is wrong.

Can anyone clarify?

[calmh (Jakob Borg)]

For two devices A and B both behind NAT it’s sufficient if A can connect to B (port forward at B) or B can connect to A (port forward at A). It is not required to have port forwards on both sides.

The second sentence of the first paragraph says that if Syncthing is listening at port 1234 you must also forward port 1234 on the router, because Syncthing will tell the discovery servers that it’s listening on port 1234 and that’s where other devices will try to connect.

A port forward from port 5678 (outside) to port 1234 (inside) is fine as such, but Syncthing doesn’t know about the 5678 part and can’t tell anyone to connect to that port.