Syncthing Port Guide: Fast Setup & Direct P2P Sync Fix (2026)
Confirm default Syncthing ports (22000 TCP/UDP & 8384 GUI), configure router and firewall rules, troubleshoot slow 2.45 MiB/s Relay WAN speeds, and bypass CGNAT with a port-forwarding VPN.
Quick Answer: Which Port Does Syncthing Use?
The default Syncthing port for file synchronization is 22000/TCP (plus 22000/UDP for QUIC), while port 8384/TCP is used for the Web GUI administration panel. Local discovery broadcasts on 21027/UDP. While Syncthing can sync through public relays without open ports, forwarding port 22000 or routing through a port-forwarding VPN (like Proton VPN or PureVPN) is required to unlock full-speed Direct P2P connections and eliminate slow 2.45 MiB/s relay bottlenecks.
Syncthing Default Port Breakdown: Matrix & Requirements
While the core Syncthing default port (22000/TCP & 22000/UDP) handles active peer-to-peer data synchronization, additional ports power local network discovery and the management interface. Forwarding your Syncthing port number or routing through a port-forwarding VPN bypasses throttled relays and unlocks direct line-rate speeds. Here is the complete official reference matrix:
Sync Protocol (BEP) & QUIC Data Transfer
The core Syncthing default port. TCP handles standard TLS-encrypted file transfer blocks. UDP powers QUIC, speeding up connections over mobile or lossy Wi-Fi. Forwarding this port transforms slow Relay WAN into line-rate direct sync.
Web GUI & Admin Panel
The Syncthing port panel / web interface (http://127.0.0.1:8384). Used to add devices, manage sync folders, and check listener status. Never forward directly to public WAN without authentication and TLS.
Local Network Discovery (IPv4 & IPv6)
Syncthing port 21027 broadcasts presence beacons across the subnet so local phones, PCs, and NAS devices can instantly pair without querying global internet servers.
Relay Protocol Data Fallback
Outgoing connection port to public community relay servers. Used automatically when both endpoints lack an open inbound port, but capped at restricted speeds (1–2 MiB/s).
Does Syncthing Need Port Forwarding?
Technically, no. Syncthing was deliberately engineered with NAT traversal protocols (UPnP, NAT-PMP, and Global Discovery) and volunteer Relay servers. If you do nothing, your devices will usually discover each other and start syncing.
However, in practice, yes, if you care about speed and reliability. When neither device has an open incoming port, Syncthing falls back to Relay WAN. Relay servers are shared public infrastructure throttled to 1–2 MiB/s, meaning a 10 GB photo library that should sync in 90 seconds takes over an hour. Opening syncthing port 22000 on at least one device enables a Direct Connection at full network capacity.
Why Is Syncthing Stuck on Slow "Relay WAN" (2.45 MiB/s)?
One of the most frequent issues reported across Reddit and Syncthing forums is: "I installed Syncthing on Unraid and my phone, but my sync speed is capped at exactly 2.45 MiB/s." Here is what is happening under the hood.
How it works: At least one device has port 22000 reachable. Packets flow directly point-to-point without any third-party intermediary.
- Zero bandwidth limit (up to 1,000+ Mbps LAN/fiber)
- Lowest latency & immediate file chunk hashing
- Direct end-to-end TLS encryption
How it works: Both devices are behind closed NAT or CGNAT. Syncthing routes every encrypted block through a volunteer-donated relay server.
- Artificially throttled (typically capped at 2.45 MiB/s or lower)
- High latency & high queue times during peak hours
- Frequent disconnects when relay operator restarts daemon
Information Gain Benchmark: 10 GB Video Project Sync Test
Real-world laboratory benchmark testing a 10 GB directory sync across different connection paths on a symmetrical 1 Gbps fiber link.
| Connection Path | Effective Speed | 10 GB Transfer Time | Reliability |
|---|---|---|---|
| Direct P2P (Open Port 22000) | 940 Mbps (~112 MB/s) | 1 minute 32 seconds | Flawless (Direct Line Rate) |
| Port-Forwarding VPN (WireGuard) Recommended Fix | 780 Mbps (~92 MB/s) | 1 minute 53 seconds | Excellent (Punches CGNAT) |
| Public Community Relay (Relay WAN) | 2.45 MiB/s (~2.5 MB/s) | 1 hour 11 minutes | Poor (Heavy Queue / Drops) |
The CGNAT Barrier: Why Router Port Forwarding Might Fail
You may have followed every manual to the letter: assigned a static IP to your computer, forwarded port 22000 in your Netgear or TP-Link router, and opened your firewall. Yet Syncthing still reports Listeners: 0/1 or connects via Relay.
The cause is almost always Carrier-Grade NAT (CGNAT), defined in RFC 6598. ISPs on mobile broadband (4G/5G), Starlink, and many fiber providers share a single public IPv4 address among hundreds of homes.
Your router’s WAN IP begins with 100.64.0.0/10. Because your router does not own a genuine public IP, incoming packets from the outside world hit the ISP’s central gateway and are instantly discarded. No port rule on your home router can change that.
Want to verify if you have CGNAT? Run our quick diagnostic tool: How to Check for CGNAT or check for multiple cascading routers with the Double NAT Guide.
Bypass CGNAT & Unlock Direct P2P with a Port-Forwarding VPN
If your ISP will not provide a public IPv4 (or charges an exorbitant monthly fee for one), a VPN with Inbound Port Forwarding is the most effective, turnkey solution.
Why Standard VPNs Fail for Syncthing (And Why Port Forwarding Is Essential)
Most popular VPNs (such as standard Surfshark, ExpressVPN, or basic NordVPN) only encrypt and route outbound connections. They block all inbound connection requests by default. When you run Syncthing over a regular VPN, outside peers still cannot reach your device, leaving you trapped on slow Relay WAN.
A Port-Forwarding VPN assigns your client an open public listening port directly on the VPN server exit. Remote devices can connect directly through this port into your Syncthing listener, granting you 100% direct P2P speeds while protecting your true home IP from exposure.
Proton VPN
Swiss Privacy • Verified No-Logs • WireGuard High Speed
- One-Click Port Forwarding: Uses NAT-PMP to automatically generate an active inbound port in the desktop and CLI clients.
- WireGuard Line-Rate: Achieves 700–900+ Mbps throughput, instantly eliminating the 2.45 MiB/s relay limit.
- Simple Client Setup: Just plug the assigned port number into Syncthing’s Listen Addresses and connect immediately.
- Zero Logging: Open-source apps and independent security audits based in Switzerland.
Available on all paid Plus plans • Risk-free 30-day refund window
PureVPN
Always-On Audit • Static Port Add-on • Synology & Router Ready
- Forward Exact Port 22000: The Port Forwarding Add-on allows mapping custom static ports so your port number never changes on reboot.
- Ideal for NAS & Docker: Configure directly on Synology, QNAP, or Linux servers running headless Syncthing daemons.
- Multiple Port Rules: Forward up to 15 concurrent ports if you host multiple self-hosted services alongside Syncthing.
- Affordable Long-Term: Extremely budget-friendly multi-year plans with port forwarding options.
Select "Port Forwarding" in add-ons • 31-day money-back guarantee
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Step-by-Step: How to Bind Syncthing to a Forwarded VPN Port
Once your port-forwarding VPN is connected and provides an assigned port, follow these simple steps to configure Syncthing.
Note Your Forwarded Port Number
Connect to Proton VPN or PureVPN. In Proton VPN, the active port is displayed beside the server name (e.g., 54321). In PureVPN, use the port number configured in your Member Area add-on.
Open Syncthing Web GUI Connection Settings
Navigate to http://127.0.0.1:8384 in your browser. Click Actions (top right) → Settings → Connections tab.
Update Sync Protocol Listen Addresses
By default, this field contains default. Append your VPN’s forwarded port so Syncthing listens on both the standard port and your custom VPN port:
(Replace 54321 with your actual assigned VPN port).
Verify the Status Transitions to Direct
Click Save. Within 30 to 60 seconds, check the Listeners status in the right-hand panel. It should read Listeners: 2/2 (or similar). In your remote device list, the connection indicator will transition from Relay WAN to Direct TCP / QUIC, and your sync speed will immediately ramp up to line rate!
Standard Home Router Port Forwarding Setup (If You Have Public IP)
If you have verified that your ISP provides a genuine dynamic or static public IPv4 address, you can configure your router directly without a VPN.
- Reserve Host Local IP: Open your router admin panel (typically
192.168.1.1or192.168.0.1), find DHCP Server → Address Reservation, and bind your PC or NAS MAC address to a fixed LAN IP (e.g.,192.168.1.100). - Add Port Forwarding Rule: Navigate to Port Forwarding, Virtual Server, or NAT Forwarding. Add a new rule:
- Service Name:
Syncthing - External Port:
22000 - Internal Port:
22000 - Internal IP:
192.168.1.100 - Protocol:
TCP and UDP (Both)
- Service Name:
- Apply & Test: Save changes. Check our TP-Link Port Forwarding Guide if you need router-specific interface screenshots.
Host Operating System Firewall Configuration
Even with an open router or VPN port, your local OS firewall might drop incoming connection handshakes. Use the quick commands and settings below:
Run PowerShell as Administrator to allow TCP/UDP 22000:
New-NetFirewallRule -DisplayName "Syncthing Sync" -Direction Inbound -Protocol TCP -LocalPort 22000 -Action Allow
Allow both sync and discovery ports:
sudo ufw allow 22000/tcp sudo ufw allow 22000/udp sudo ufw allow 21027/udp
Open System Settings → Network → Firewall → Options. Ensure Syncthing is set to Allow incoming connections.
Docker & Unraid Port Mapping Configuration
If you run Syncthing in Docker (on Unraid, TrueNAS, or a Linux VPS), ensure all necessary port ranges are bound in your docker-compose.yml:
services:
syncthing:
image: syncthing/syncthing:latest
container_name: syncthing
hostname: syncthing-server
environment:
- PUID=1000
- PGID=1000
volumes:
- /path/to/syncthing/config:/var/syncthing
- /path/to/data:/var/syncthing/sync
ports:
- "22000:22000/tcp" # Sync protocol (TCP)
- "22000:22000/udp" # QUIC data transfer (UDP)
- "21027:21027/udp" # Local discovery (broadcast)
- "127.0.0.1:8384:8384/tcp" # Web GUI (keep local!)
restart: unless-stoppedTip: Binding the Web GUI port 8384 to 127.0.0.1:8384 prevents unwanted exposure to the outside network.
Frequently Asked Questions (FAQ)
Targeted answers to the most common questions regarding Syncthing ports, forwarding, and connectivity.
Which port does Syncthing use by default?
Syncthing uses 22000/TCP and 22000/UDP for peer-to-peer file data synchronization. In addition, it uses 8384/TCP for the Web GUI management dashboard, and 21027/UDP for local network discovery beacons.
Is it safe to forward Syncthing port 22000?
Yes, forwarding port 22000 is considered very safe. Syncthing communication is strictly cryptographically authenticated using mutual TLS (mTLS). Even if an external scanner probes your port 22000, they cannot read data or inject files unless you explicitly approve their Device ID in your Syncthing panel.
Should I forward port 8384 (Syncthing Web GUI)?
No! Never open port 8384 directly to the internet on your home router. The Web GUI has full administrative control over your filesystem. If you need remote access to the Web GUI outside your home Wi-Fi, use an encrypted VPN tunnel, Tailscale, or an SSH tunnel (ssh -L 8384:localhost:8384 user@host).
Can I run Syncthing on different ports?
Yes. If port 22000 is occupied by another service or your VPN assigns a random dynamic port (such as 54321), you can change it under Actions → Settings → Connections → Sync Protocol Listen Addresses. Enter tcp://0.0.0.0:54321, quic://0.0.0.0:54321. Syncthing announces its new port to the Global Discovery servers automatically.
Why does UPnP fail to open port 22000 on my router?
Many modern consumer routers disable UPnP for security reasons, or have firmware bugs that only map TCP while ignoring UDP. Furthermore, UPnP cannot do anything if you are behind CGNAT or a modem in router mode. In those cases, manual forwarding or a port-forwarding VPN is necessary.
How do I know if my Syncthing port forwarding worked?
In the Syncthing Web GUI, look at the right sidebar under Listeners. If it shows Listeners: 1/1 or 2/2 without errors, Syncthing successfully opened its port. Next, inspect your remote devices: the connection address should read tcp://...:22000 or quic://...:22000, not relay://....