Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ecobee thermostat can’t connect to servers

    Scheduled Pinned Locked Moved General pfSense Questions
    103 Posts 10 Posters 3.7k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      ezhawk @stephenw10
      last edited by

      @stephenw10
      If the servers just stop responding, why do they only stop responding behind pfSense and not when it is behind a Cisco device?

      GPz1100G 1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        Good question. And they may not stop responding. We need to gather more data from the failed situation.

        I assume you see nothing blocked in the logs?

        E 1 Reply Last reply Reply Quote 0
        • GPz1100G Offline
          GPz1100 @ezhawk
          last edited by GPz1100

          @ezhawk When behind pfsense, and lost ecobee connectivity, did you try rebooting the ecobee?

          You can reboot it by pulling it off the wall, or a better way is flip the breaker for the hvac system. Leave it off a few sec, then turn it back on.

          As I mentioned earlier in this thread, the only issues i've had with ecobee have been with the lite version where after a period of time it would develop morse code in the data. Likely due to a memory leak or some run away process. Rebooting it would fix this for a while. Ecobee eventually replaced the unit with the premium (which has better cpu/more ram), which hasn't has this issue.

          Edit: I didn't have to make any special adjustmentsfor pfsense states/ecobee client settings. Whatever default state timeouts are in place work fine here.

          Is the cisco router using the same primary internet connection as pfsense?

          1 Reply Last reply Reply Quote 0
          • E Offline
            ezhawk @stephenw10
            last edited by

            @stephenw10 said in Ecobee thermostat can’t connect to servers:

            Good question. And they may not stop responding. We need to gather more data from the failed situation.

            I assume you see nothing blocked in the logs?

            I've put my Ecobee back through the pfSense. We'll see how long it lasts until it stops connecting. I did just update to 25.07.1 on the pfSense yesterday.

            @GPz1100 said in Ecobee thermostat can’t connect to servers:

            @ezhawk When behind pfsense, and lost ecobee connectivity, did you try rebooting the ecobee?

            You can reboot it by pulling it off the wall, or a better way is flip the breaker for the hvac system. Leave it off a few sec, then turn it back on.

            As I mentioned earlier in this thread, the only issues i've had with ecobee have been with the lite version where after a period of time it would develop morse code in the data. Likely due to a memory leak or some run away process. Rebooting it would fix this for a while. Ecobee eventually replaced the unit with the premium (which has better cpu/more ram), which hasn't has this issue.

            Edit: I didn't have to make any special adjustmentsfor pfsense states/ecobee client settings. Whatever default state timeouts are in place work fine here.

            Is the cisco router using the same primary internet connection as pfsense?

            I've rebooted the Ecobee countless times. If that was the fix, I'd be glad, but it isn't. I don't have a lite, I have a premium.

            Yes, the Cisco and pfSense are literally plugged into the same modem with each device getting its own unique public IP.

            GPz1100G 1 Reply Last reply Reply Quote 0
            • GPz1100G Offline
              GPz1100 @ezhawk
              last edited by

              @ezhawk Each firewall is getting a different public ip. That complicates things.

              Test with the same public IP for each device.

              E 1 Reply Last reply Reply Quote 0
              • E Offline
                ezhawk @GPz1100
                last edited by

                @GPz1100 said in Ecobee thermostat can’t connect to servers:

                @ezhawk Each firewall is getting a different public ip. That complicates things.

                Test with the same public IP for each device.

                I cannot run both at the same time with having the same IP and I also don't have static IPs. As I've said multiple times, behind pfSense it'll work for a few weeks and the stop. The temp fix is to spoof and get a new IP. I had the Ecobee behind the a Cisco with the same IP for more than 2 months and it never dropped once. I've been through more than a dozen different IPs trying to figure it out by using spoofing methods. The IP itself isn't the issue.

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  And just to confirm when this happens everything else behind pfSense remains functional? Only the Ecobee seems to be affected?

                  E 2 Replies Last reply Reply Quote 0
                  • E Offline
                    ezhawk @stephenw10
                    last edited by

                    @stephenw10 said in Ecobee thermostat can’t connect to servers:

                    And just to confirm when this happens everything else behind pfSense remains functional? Only the Ecobee seems to be affected?

                    That is correct. Every other device that goes through the pfSense works normally.

                    1 Reply Last reply Reply Quote 1
                    • E Offline
                      ezhawk @stephenw10
                      last edited by ezhawk

                      @stephenw10
                      well, that didn't take long. once again, behind the pfsense my ecobee now shows disconnected. Network connectivity is all up. I can ping out from the ecobee by ip and dns name, but the pfsense is blocking its connection to the ecobee.com servers.

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • GertjanG Offline
                        Gertjan @ezhawk
                        last edited by

                        @ezhawk said in Ecobee thermostat can’t connect to servers:

                        but the pfsense is blocking its connection to the ecobee.com servers.

                        Blocking : what pfSense rule blocks traffic from the bee ?
                        Can you list the firewall rules on that LAN ?
                        Is the bee set up to use DHCP ? If so : read How to change Kea DHCP log level so now you know how to log DHCP leases : and the question is : did it get a DHCP lease (that is an IP, a network, a gateway, a DNS - check these all) ?
                        If static : what is it's setup ?

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S Offline
                          stephenw10 Netgate Administrator
                          last edited by

                          Mmm, what connection is actually being blocked?

                          If you kill all the states from the thermostat and allow it to open new states does that fix the connection? If not do any of those states have one way traffic with no replies?

                          GPz1100G E 2 Replies Last reply Reply Quote 0
                          • GPz1100G Offline
                            GPz1100 @stephenw10
                            last edited by GPz1100

                            Under steady state conditions I show the ecobee premium connecting to a single ip.

                            67a13b98-e9e5-4a80-baa2-1464cd5fa15d-image.png

                            and periodic connections to the dns server (x.y.100.2).

                            Using any packages that may be doing traffic inspection?

                            1 Reply Last reply Reply Quote 0
                            • E Offline
                              ezhawk @stephenw10
                              last edited by

                              @stephenw10

                              I've killed all the states and the connection doesn't restore. I reboot the ecobee and after letting everything come up clear out these are what i'm left with for states and the ecobee cannot connect to the ecobee servers.

                              (I had this exact same issue with Google Nest and assumed it was something with Nest which is why I now have an ecobee.)

                              3ccb378e-bd0d-4acc-ac5b-282df908256b-image.png

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S Offline
                                stephenw10 Netgate Administrator
                                last edited by

                                Hmm, OK so two way traffic but both state sets are in FIN-WAIT rather than established and only 4 packets.

                                Try pcapping that traffic and see what's going on.

                                Interesting that it's the same remote address for both of you.

                                Can you try routing that traffic over a VPN to get a completely different source IP?

                                E GPz1100G 2 Replies Last reply Reply Quote 0
                                • E Offline
                                  ezhawk @stephenw10
                                  last edited by

                                  @stephenw10

                                  I did pcaps from the WAN and LAN and rebooted the ecobee each time but not sure exactly what i'd be looking for in the pcap. I don't have a VPN to route traffic over.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S Offline
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    I'm away right now so I can't setup a drop-link. But do the captures show just the 4 packets shown in the state table for each connection?

                                    E 1 Reply Last reply Reply Quote 0
                                    • E Offline
                                      ezhawk @stephenw10
                                      last edited by

                                      @stephenw10
                                      i see some fin acks both ways. after a while all the states drop and then it comes back and in the states it just sits at fin wait.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S Offline
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Can we see the pcap from the pfSense gui with the TCP flags? You can obscure the IPs if you need.

                                        We need to see which side stops responding.

                                        E 1 Reply Last reply Reply Quote 0
                                        • E Offline
                                          ezhawk @stephenw10
                                          last edited by

                                          @stephenw10

                                          wan pcap
                                          1338d7ae-d96b-4c08-bbf8-d7bfaad8a869-image.png

                                          lan pcap
                                          c03e2ead-caf7-4bd1-976b-e334fd43c475-image.png

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S Offline
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Hmm, interesting. That dupe ACK is odd. Like the server expects to see something from the client and doesn't. Except the dupe comes 12 microseconds after the first. Other than that it looks like a pretty normal TCP connection. The client just isn't sending or pulling anything. I do note there are no large packets shown. But they are not present on either interface. pfSense seems to be passing that traffic as expected. 😕
                                            Even when the dupe ACK doesn't happen the server sends a fin-ack pretty much immediately.

                                            GPz1100G 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.