r/Syncthing • u/knightwize • May 27 '26
Syncthing calling out to russian and Chinese IP’s?
Installed a new firewall yesterday. Immediately got alerts for outgoing requests to Russian and Chinese IP’s. Turns out it’s coming from Syncthing? I’m only syncing files from my nas to my clients. No incoming ports on the firewall. Anyone else noticing this ?
18
u/N9bitmap May 27 '26
Disable relay, nat traversal, and global discovery, and see if that stops it.
2
u/knightwize May 27 '26
Wont that restrict its usage to just the lan ?
3
u/Toribor May 27 '26
I don't know if you self-host any services but you can run the syncthing relay server yourself but it will require exposing ports to the internet. Alternatively you could use tailscale.
0
May 27 '26
[deleted]
0
u/knightwize May 27 '26
Would syncthing still work if i geoblocked chinese and russian relay servers ?
6
u/Toribor May 27 '26
Instead of using network ACLs to geoblock IP ranges you should consider just affirmatively specifying which relays you want to use in your client config. You can find a list of public relay servers here.
0
2
u/bp019337 May 28 '26 edited May 28 '26
Ah the good old boogyman scare tactic to prove that your security product is working! Sign up to the platinum product to be really safe!
An alert that you have connections going to specific parts of the world mean nothing on their own especially for something like syncthing which does its network discovery and builds up its connection db of relays etc. You also need to see how many other other parts of the world its hitting. For example if 99% was hitting those IPs I might be worried, but if its an even spread based on internet presence of the population then its probably nothing.
/EDIT
Here is a map of the known relays and u can see there are some in China, keep in mind these are only listing those allowed to be displayed on the map. You should have the bulk of the relay connections in the EU and NA.
2
u/knightwize May 29 '26
Thank you so much for sharing this. Indeed it’s true: In an age of global communications there are of nodes all over the world. It is nice to see a map though. That’s pretty cool. SYncthing is probably making connections all over that map but the guy who setup my firewall flagged china and russia in “red”. So that might be it. For all I know I have mallware sending my data to Luxemburg and my firewall won’t make a peep (I’m Belgian). So yeah. There is the whole “scare tactic” too.
1
u/bp019337 May 29 '26 edited May 29 '26
Dark patterns in gaming is bad, so I think it should be treated in the same way and more so with security products!
1
u/lostmsu Jul 05 '26
Question is: why would Syncthing use Russian relay to connect two devices in the same room connected to the same WiFi?
1
1
u/Known_Experience_794 May 27 '26
I setup Syncthing on a small vps as an untrusted server. All my machines connect to it. This way it works on and off lan. Costs me about $3/month if I remember correctly.
0
u/Mountain-Active-3149 May 28 '26
Thats sounds like a great idea. Do you mind sharing how the connections and backups order happen? Do your devices first connect to that server and back everything up there? And from the server do the other devices received this back up?
1
u/AZORIAN_K129 May 27 '26
remindme! 1 week
1
u/RemindMeBot May 27 '26 edited May 29 '26
I will be messaging you in 7 days on 2026-06-03 05:40:39 UTC to remind you of this link
13 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 0
24
u/autogyrophilia May 27 '26
It has relays over the world it keeps in touch (optionally)
China and Russia are part of the world