Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ecobee thermostat can’t connect to servers

    Scheduled Pinned Locked Moved General pfSense Questions
    103 Posts 10 Posters 3.6k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      ezhawk @stephenw10
      last edited by

      @stephenw10

      I've killed all the states and the connection doesn't restore. I reboot the ecobee and after letting everything come up clear out these are what i'm left with for states and the ecobee cannot connect to the ecobee servers.

      (I had this exact same issue with Google Nest and assumed it was something with Nest which is why I now have an ecobee.)

      3ccb378e-bd0d-4acc-ac5b-282df908256b-image.png

      1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        Hmm, OK so two way traffic but both state sets are in FIN-WAIT rather than established and only 4 packets.

        Try pcapping that traffic and see what's going on.

        Interesting that it's the same remote address for both of you.

        Can you try routing that traffic over a VPN to get a completely different source IP?

        E GPz1100G 2 Replies Last reply Reply Quote 0
        • E Offline
          ezhawk @stephenw10
          last edited by

          @stephenw10

          I did pcaps from the WAN and LAN and rebooted the ecobee each time but not sure exactly what i'd be looking for in the pcap. I don't have a VPN to route traffic over.

          1 Reply Last reply Reply Quote 0
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            I'm away right now so I can't setup a drop-link. But do the captures show just the 4 packets shown in the state table for each connection?

            E 1 Reply Last reply Reply Quote 0
            • E Offline
              ezhawk @stephenw10
              last edited by

              @stephenw10
              i see some fin acks both ways. after a while all the states drop and then it comes back and in the states it just sits at fin wait.

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Can we see the pcap from the pfSense gui with the TCP flags? You can obscure the IPs if you need.

                We need to see which side stops responding.

                E 1 Reply Last reply Reply Quote 0
                • E Offline
                  ezhawk @stephenw10
                  last edited by

                  @stephenw10

                  wan pcap
                  1338d7ae-d96b-4c08-bbf8-d7bfaad8a869-image.png

                  lan pcap
                  c03e2ead-caf7-4bd1-976b-e334fd43c475-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    Hmm, interesting. That dupe ACK is odd. Like the server expects to see something from the client and doesn't. Except the dupe comes 12 microseconds after the first. Other than that it looks like a pretty normal TCP connection. The client just isn't sending or pulling anything. I do note there are no large packets shown. But they are not present on either interface. pfSense seems to be passing that traffic as expected. 😕
                    Even when the dupe ACK doesn't happen the server sends a fin-ack pretty much immediately.

                    GPz1100G 1 Reply Last reply Reply Quote 0
                    • GPz1100G Offline
                      GPz1100 @stephenw10
                      last edited by

                      @ezhawk re vpn

                      You can set up a free cloudflare warp wireguard connection using this project - https://github.com/ViRb3/wgcf .

                      From the releases page download the one appropriate for your pfsense architecture (or a linux vm).

                      Run wgcf register then wgcf generate

                      This will create a .conf file from which you can pull the necessary credentials to supply pf's wg package. Use policy based routing to pass ecobee traffic through the cf tunnel. Don't forget to create an outbound nat rule.

                      1 Reply Last reply Reply Quote 0
                      • GPz1100G Offline
                        GPz1100 @stephenw10
                        last edited by

                        @stephenw10 It would be interesting to compare the state timeout values between pfsense and the other firewall @ezhawk is using. Possible some values are longer in pfsense and/or not playing nicely with the isp?

                        Looking at the pfs/system_advanced_firewall.php page, all mine are default. WAN MTU at 1500 too (att fiber connection).

                        E stephenw10S 2 Replies Last reply Reply Quote 0
                        • E Offline
                          ezhawk @GPz1100
                          last edited by

                          @GPz1100
                          mine are all default in the firewall settings too. WAN mtu is actually just using the adaptors default. Don't have any defined MTU.

                          GPz1100G 1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator @GPz1100
                            last edited by

                            @GPz1100 Are you able to grab a pcap for comparison with a working connection?

                            GPz1100G 1 Reply Last reply Reply Quote 0
                            • GPz1100G Offline
                              GPz1100 @stephenw10
                              last edited by

                              @stephenw10 What specifically do you want captured, and for how long? I can use the pf packet capture gui option but what options do you want set there?

                              The ecobee is on the IOT vlan which only has rfc1918 access to dns server and internet.

                              1 Reply Last reply Reply Quote 0
                              • GPz1100G Offline
                                GPz1100 @ezhawk
                                last edited by

                                @ezhawk said in Ecobee thermostat can’t connect to servers:

                                @GPz1100
                                mine are all default in the firewall settings too. WAN mtu is actually just using the adaptors default. Don't have any defined MTU.

                                I understand, but since it is working with the other firewall, there must be some difference, no?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S Offline
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Just a typical TCP stream from the client to the server. Is it sending/receiving large packets every connection for example? Does the connection just remain open?

                                  GPz1100G 1 Reply Last reply Reply Quote 0
                                  • GPz1100G Offline
                                    GPz1100 @stephenw10
                                    last edited by

                                    @stephenw10 Attached is a sanitized pcap. Ecobee mac and lan interace mac sanitized to begin with bb dd cc and lan mac begins with 11 22 33.

                                    sanitizedpacketcapture--20250828135527.pcap

                                    The capture is a 10 min segment of steady state operation.

                                    Note, the ecobee tries to resolve api.amazon.com every 50s. This is denied via dns server as well as blocking the entire amazon asn for the ecobee ip.

                                    Hope this helps.

                                    PS. please delete the previous message - it's already tagged as deleted, please remove permanently.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S Offline
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Hmm, so it normally just holds open the TCP connection continually.

                                      GPz1100G 1 Reply Last reply Reply Quote 0
                                      • GPz1100G Offline
                                        GPz1100 @stephenw10
                                        last edited by

                                        @stephenw10 That's why I asked what packages were installed. Perhaps something is interfering.

                                        E 1 Reply Last reply Reply Quote 0
                                        • E Offline
                                          ezhawk @GPz1100
                                          last edited by

                                          @GPz1100 @stephenw10
                                          don't have too many installed.

                                          5d6f7cb9-1ad1-49cd-8879-79f123b56857-image.png

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S Offline
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Hmm, are you able to capture the initial connection from the client to the server?

                                            E 3 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.