edit: ignore this, the software can relay connections when direct connection is impossible.
Just found this in the FAQ:
> If you see outgoing connections to odd and unexpected addresses these are most likely connections to relay servers. Relay servers are run by volunteers all over the world. They usually listen on ports 443 or 22067, though this is controlled by the user running it. You can compare the address you are concernced about with the current list of active relays. Relays do not and can not see the data transmitted via them.
"Syncthing relies on a discovery server to find peers on the internet. Anyone can run a discovery server and point Syncthing installations to it. The Syncthing project also maintains a global cluster for public use."
