But if two nodes that have added each other's keys cannot reach each other directly (e.g. are in separate private networks/behind firewalls/etc) but both can reach an external relay server, it may act as a dumb pipe bouncing encrypted traffic between them.
https://docs.syncthing.net/users/relaying.html
There is a public pool of such relay servers (https://relays.syncthing.net/), and by default syncthing will reach out and connect/announce its itself there so other nodes looking for it could contact it via a relay.
You can host your own relay server and configure your clients to use it exclusively: https://docs.syncthing.net/users/strelaysrv.html#client-conf... or if you only want syncing when your nodes are on the same local network you should be able to just not configure any relays at all.