NAME

       strelaysrv - Syncthing Relay Server

SYNOPSIS

          strelaysrv [-debug] [-ext-address=<address>] [-global-rate=<bytes/s>] [-keys=<dir>] [-listen=<listen addr>]
                     [-message-timeout=<duration>] [-nat] [-nat-lease=<duration> [-nat-renewal=<duration>]
                     [-nat-timeout=<duration>] [-network-timeout=<duration>] [-per-session-rate=<bytes/s>]
                     [-ping-interval=<duration>] [-pools=<pool addresses>] [-protocol=<string>] [-provided-by=<string>]
                     [-status-srv=<listen addr>]

DESCRIPTION

       Syncthing  relies on a network of community-contributed relay servers. Anyone can run a relay server, and
       it will automatically join the relay pool and be available to Syncthing users. The current list of relays
       can be found at http://relays.syncthing.net/.

OPTIONS

       -debug Enable debug output.

       -ext-address=<address>
              An optional address to advertising as being available on. Allows listening on an unprivileged port
              with port forwarding from e.g. 443, and be connected to on port 443.

       -global-rate=<bytes/s>
              Global rate limit, in bytes/s.

       -keys=<dir>
              Directory where cert.pem and key.pem is stored (default “.”).

       -listen=<listen addr>
              Protocol listen address (default “:22067”).

       -message-timeout=<duration>
              Maximum amount of time we wait for relevant messages to arrive (default 1m0s).

       -nat   Use UPnP/NAT-PMP to acquire external port mapping

       -nat-lease=<duration>
              NAT lease length in minutes (default 60)

       -nat-renewal=<duration>
              NAT renewal frequency in minutes (default 30)

       -nat-timeout=<duration>
              NAT discovery timeout in seconds (default 10)

       -network-timeout=<duration>
              Timeout for network operations between the client and the relay. If no data  is  received  between
              the  client and the relay in this period of time, the connection is terminated. Furthermore, if no
              data is sent between either clients being relayed within this period of time, the session is  also
              terminated. (default 2m0s)

       -per-session-rate=<bytes/s>
              Per session rate limit, in bytes/s.

       -ping-interval=<duration>
              How often pings are sent (default 1m0s).

       -pools=<pool addresses>
              Comma     separated     list     of     relay    pool    addresses    to    join    (default    “‐
              http://relays.syncthing.net/endpoint”). Blank to disable announcement to a pool, thereby remaining
              a private relay.

       -protocol=<string>
              Protocol used for listening. ‘tcp’ for IPv4 and IPv6, ‘tcp4’ for IPv4, ‘tcp6’  for  IPv6  (default
              “tcp”).

       -provided-by=<string>
              An optional description about who provides the relay.

       -status-srv=<listen addr>
              Listen  address  for status service (blank to disable) (default “:22070”).  Status service is used
              by the relay pool server UI for displaying stats (data transfered, number of clients, etc.)

SETTING UP

       Primarily, you need to decide on a directory to store the TLS key and certificate and a listen port.  The
       default listen port of 22067 works, but for optimal compatibility a well known port for encrypted traffic
       such  as  443  is  recommended.  This  may  require additional setup to work without running as root or a
       privileged user, see Running on port 443 as an unprivileged user below. In principle something similar to
       this should work on a Linux/Unix system:

          $ sudo useradd relaysrv
          $ sudo mkdir /etc/relaysrv
          $ sudo chown relaysrv /etc/relaysrv
          $ sudo -u relaysrv /usr/local/bin/relaysrv -keys /etc/relaysrv

       This creates a user relaysrv and a directory /etc/relaysrv to store the keys. The keys are  generated  on
       first startup. The relay will join the global relay pool, unless a -pools="" argument is given.

       To  make  the  relay server start automatically at boot, use the recommended procedure for your operating
       system.

   Client configuration
       Syncthing can be configured to use specific relay servers (exclusively of the public pool) by adding  the
       required  servers to the Sync Protocol Listen Address field, under Actions and Settings. The format is as
       follows:
          relay://<host name|IP>[:port]/?id=<relay device ID>

       For example:
          relay://private-relay-1.example.com:443/?id=ITZRNXE-YNROGBZ-HXTH5P7-VK5NYE5-QHRQGE2-7JQ6VNJ-KZUEDIU-5PPR5AM

       The relay’s device ID is output on start-up.

   Running on port 443 as an unprivileged user
       It is recommended that you run the relay on port 443 (or another port which is commonly  allowed  through
       corporate  firewalls), in order to maximise the chances that people are able to connect. However, binding
       to ports below 1024 requires root privileges, and running a relay as root is not recommended.  Thankfully
       there are a couple of approaches available to you.

       One  option  is to run the relay on port 22067, and use an iptables rule to forward traffic from port 443
       to port 22067, for example:

          iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 22067

       Or, if you’re using ufw, add the following to /etc/ufw/before.rules:

          *nat
          :PREROUTING ACCEPT [0:0]
          :POSTROUTING ACCEPT [0:0]

          -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 22067

          COMMIT

       You will need to start relaysrv with -ext-address ":443". This tells relaysrv that it can be contacted on
       port 443, even though it is listening on port 22067. You will also need to let both port  443  and  22067
       through your firewall.

       Another option is described here <https://wiki.apache.org/httpd/NonRootPortBinding>, although your milage
       may vary.

FIREWALL CONSIDERATIONS

       The  relay  server listens on two ports by default.  One for data connections and the other for providing
       public statistics at http://relays.syncthing.net/.  The firewall, such as iptables, must permit  incoming
       TCP connections to the following ports:

       • Data port:  22067/tcp overridden with -listen and advertised with -ext-address

       • Status port: 22070/tcp overridden with -status-srv

       Runtime iptables rules to allow access to the default ports:

          iptables -I INPUT -p tcp --dport 22067 -j ACCEPT
          iptables -I INPUT -p tcp --dport 22070 -j ACCEPT

       Please consult Linux distribution documentation to persist firewall rules.

SEE ALSO

       syncthing-relay(7), syncthing-faq(7), syncthing-networking(7)

AUTHOR

       The Syncthing Authors

COPYRIGHT

       2015, The Syncthing Authors

v0.14                                             Dec 19, 2017                                     STRELAYSRV(1)