Ecobee thermostat can’t connect to servers
-
@ezhawk Other than the macs, I saw some exchanges include plain text tstat serial number (the PTR requests). Everything else I think is encrypted, at least between the tstat and ecobee. I can't comment on the amazon traffic as that's all blocked here.
-
-
@ezhawk Is there a pcap when it's acting up? Or was that the one on the previous page?
-
@GPz1100 that pcap is yesterday when i rebooted the ecobee and it can't connect to ecobee.com
-
Hmm, nothing there really looks like a routing problem. If you told me that was it working normally I would believe it.
It has no problem connecting to home-fw.ecobee.com. Including with large packets. Though I note that's at a completely different IP than idt.
It ARPs for 10.99.0.35. Do you know what that is?
-
@stephenw10
That's my Home Assistant server. Ecobee is integrated via Apple HomeKit into HA. -
Hmm, and I assume that continues to work fine even when it stops connecting to ecobee's servers?
-
@stephenw10
Yes, there isn't any issue from HA to the Ecobee when the Ecobee cannot connect to the Ecobee servers. -
@ezhawk Which ecobee model is this?
-
@GPz1100 I have the Enhanced model.
-
Hmm, so previously when this happened you were only able to get it to reconnect by forcing a change in the WAN IP?
There might be some clue if you were able to capture the traffic at the point it failed but that could be tough. It's unpredictable as I understand it.
-
@stephenw10
Something happened the other night that really points to the pfSense. I took a power hit and my UPS failed and the pfSense reloaded. After the reload, the Ecobee is online via the pfSense. I double checked and my WAN IP did not change either. I got the same IP that I had before the reload. So, in my mind that completely rules out idea that my IP is somehow being blacklisted if a simple reload of the pfSense restores connectivity. -
@ezhawk Still think this is somehow a states problem.
In pftop, I noticed this,
Under exp, it resets to 86400 every 30-60s. It's almost as somehow this isn't working right on your end.
-
@GPz1100
and now...it has lost connection to the server again
-
This is what I always see when behind pfSense.
-
The state expiry time for a TCP established state is a lot longer than one in fin_wait. Since in the failure mode it never reaches established it expires and is recreated. But the pcap shows the server side sends the fin packe. Like it's just refusing the connection from that thermostat. Or that IP.
I assume that normally rebooting pfSense does not bring back the connection? That only happened after the power outage reboot?
Did that also reboot the modem or whatever you have on the WAN side? -
@stephenw10
I try to not reboot pfSense or modem if I don't have to. I honestly haven't done that in troubleshooting since IP changes brings the connection back up or using an internet not through pfSense restores it too. The reboot the other day wasn't intended. -
Ah so it could be that rebooting pfSense allows it to reconnect every time. That would certainly point at a pf problem. Especially since clearing the states does not. I guess confirm that next then if you're able.
-
@stephenw10
I rebooted the pfSense again this morning. And it didn't restore the ecobee. -
@ezhawk if they are sending you a fin,ack - not sure how you think this could have anything to do with pfsense.. For whatever reason they are not wanting to talk to your device, maybe the public IP? But if they send you fin,ack - that is not something pfsense has control over.
