Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ecobee thermostat can’t connect to servers

    Scheduled Pinned Locked Moved General pfSense Questions
    103 Posts 10 Posters 3.6k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      ezhawk @stephenw10
      last edited by

      @stephenw10
      That's my Home Assistant server. Ecobee is integrated via Apple HomeKit into HA.

      1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        Hmm, and I assume that continues to work fine even when it stops connecting to ecobee's servers?

        E 1 Reply Last reply Reply Quote 0
        • E Offline
          ezhawk @stephenw10
          last edited by

          @stephenw10
          Yes, there isn't any issue from HA to the Ecobee when the Ecobee cannot connect to the Ecobee servers.

          GPz1100G 1 Reply Last reply Reply Quote 0
          • GPz1100G Offline
            GPz1100 @ezhawk
            last edited by

            @ezhawk Which ecobee model is this?

            E 1 Reply Last reply Reply Quote 0
            • E Offline
              ezhawk @GPz1100
              last edited by

              @GPz1100 I have the Enhanced model.

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Hmm, so previously when this happened you were only able to get it to reconnect by forcing a change in the WAN IP?

                There might be some clue if you were able to capture the traffic at the point it failed but that could be tough. It's unpredictable as I understand it.

                E 1 Reply Last reply Reply Quote 0
                • E Offline
                  ezhawk @stephenw10
                  last edited by

                  @stephenw10
                  Something happened the other night that really points to the pfSense. I took a power hit and my UPS failed and the pfSense reloaded. After the reload, the Ecobee is online via the pfSense. I double checked and my WAN IP did not change either. I got the same IP that I had before the reload. So, in my mind that completely rules out idea that my IP is somehow being blacklisted if a simple reload of the pfSense restores connectivity.

                  GPz1100G 1 Reply Last reply Reply Quote 0
                  • GPz1100G Offline
                    GPz1100 @ezhawk
                    last edited by

                    @ezhawk Still think this is somehow a states problem.

                    In pftop, I noticed this,

                    e60b1a1f-cc82-4a9d-800e-aeae76895483-image.png

                    Under exp, it resets to 86400 every 30-60s. It's almost as somehow this isn't working right on your end.

                    E 1 Reply Last reply Reply Quote 0
                    • E Offline
                      ezhawk @GPz1100
                      last edited by

                      @GPz1100
                      and now...it has lost connection to the server again

                      96733d85-de7f-4144-9701-9488adb51da6-image.png

                      E 1 Reply Last reply Reply Quote 0
                      • E Offline
                        ezhawk @ezhawk
                        last edited by

                        This is what I always see when behind pfSense.

                        6adfbf36-9dae-4f35-803a-1de34cdf3f60-image.png

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S Offline
                          stephenw10 Netgate Administrator
                          last edited by

                          The state expiry time for a TCP established state is a lot longer than one in fin_wait. Since in the failure mode it never reaches established it expires and is recreated. But the pcap shows the server side sends the fin packe. Like it's just refusing the connection from that thermostat. Or that IP.

                          I assume that normally rebooting pfSense does not bring back the connection? That only happened after the power outage reboot?
                          Did that also reboot the modem or whatever you have on the WAN side?

                          E 1 Reply Last reply Reply Quote 0
                          • E Offline
                            ezhawk @stephenw10
                            last edited by

                            @stephenw10
                            I try to not reboot pfSense or modem if I don't have to. I honestly haven't done that in troubleshooting since IP changes brings the connection back up or using an internet not through pfSense restores it too. The reboot the other day wasn't intended.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S Offline
                              stephenw10 Netgate Administrator
                              last edited by

                              Ah so it could be that rebooting pfSense allows it to reconnect every time. That would certainly point at a pf problem. Especially since clearing the states does not. I guess confirm that next then if you're able.

                              E 1 Reply Last reply Reply Quote 0
                              • E Offline
                                ezhawk @stephenw10
                                last edited by

                                @stephenw10
                                I rebooted the pfSense again this morning. And it didn't restore the ecobee.

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ Online
                                  johnpoz LAYER 8 Global Moderator @ezhawk
                                  last edited by johnpoz

                                  @ezhawk if they are sending you a fin,ack - not sure how you think this could have anything to do with pfsense.. For whatever reason they are not wanting to talk to your device, maybe the public IP? But if they send you fin,ack - that is not something pfsense has control over.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                                  E 1 Reply Last reply Reply Quote 0
                                  • E Offline
                                    ezhawk @johnpoz
                                    last edited by

                                    @johnpoz pretty easy. when the connection is behind a Cisco device it connects just fine and stays connected for the multiple months i had it connected.. when it is behind the pfSense it can't connect or loses connectivity within days and won't ever restore.

                                    Common sense is the only thing that is different between the two is the introduction of the pfSense. There is something with the pfSense that is preventing connectivity.

                                    johnpozJ patient0P 2 Replies Last reply Reply Quote 0
                                    • johnpozJ Online
                                      johnpoz LAYER 8 Global Moderator @ezhawk
                                      last edited by johnpoz

                                      @ezhawk so your public IP is the same? How is it preventing connectivity - in your capture they send you a fin,ack.. This not preventing connectivity..

                                      Pfsense not sending on something would be preventing connectivity - but if your talking to the device and they send you a fin,ack - they are saying they don't want to talk to you any more.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                                      E 1 Reply Last reply Reply Quote 0
                                      • patient0P Offline
                                        patient0 @ezhawk
                                        last edited by

                                        @ezhawk is there a way to provoke a connection to the Ecobee server on purpose, something that could be tried while on the Cisco and once while on pfSense (when it's not working). Capture both traffics and see what the difference is?

                                        Maybe the Cisco router prevented the Ecobee from e.g. making too many connection in a short time and pfSense doesn't.

                                        1 Reply Last reply Reply Quote 0
                                        • E Offline
                                          ezhawk @johnpoz
                                          last edited by

                                          @johnpoz
                                          Here we go again. Let's rehash everything in this thread already
                                          Ecobee behind pfSense doesn't work. No server connectivity. I spoof my WAN mac to get a new IP. Connection works for 1-14 days and then connection fails and it will never restore. We have done pcaps, both wan and lan side. When ecobee is connected to Cisco it will remain connected for MONTHS, no drops and no issues. put traffic back on the pfSense and will work for 1-14 days before dropping again and will NOT reconnect. I've gone through the mac spoofing no less than 6 times and it has behaved the same every single time. If it were the WAN IP getting black listed, explain why it only gets black listed when connected to pfSense and never gets black listed connected to Cisco?

                                          Pretty clear cut the introduction of the pfSense is the change that causes the failure.

                                          If you can tell me why when my internet path is 100% the same from Cisco or the pfSense and the connection ONLY fails on pfSense that the issue is not the pfSense I'm all ears. But I don't see any logic that can point to anything but the pfSense.

                                          @patient0
                                          i only introduced the Cisco after having to do repeated IP changes on the pfSense to restore connectivity. so, instead of always changing IPs i stood up a second egress device to specifically send the ecobee traffic around the pfSense so I can keep connection working. I also did it as a PoC to show the pfSense is the source of the problem.

                                          patient0P 1 Reply Last reply Reply Quote 0
                                          • patient0P Offline
                                            patient0 @ezhawk
                                            last edited by

                                            @ezhawk said in Ecobee thermostat can’t connect to servers:

                                            i only introduced the Cisco after having to do repeated IP changes...

                                            I understand and I read through this thread. I understand or assume that it is frustrating.
                                            Different router OS's behave different, maybe one has a fix for something that another hasn't. Just to be clear, I don't doubt that pfSense makes Ecobee behave as it is. If stephenw10 or johnpoz can't find the source with package capture, it has to be a sneaky issue/bug.

                                            Since it seems complicated to find the source of the issue, trying to replicate a defined situation where it works on device A but not device B seemed an approach worth considering (at least for software projects that's what you would do).

                                            Another thing I'd try is sending a support request to Ecobee to clarify if they rate-limit or block your IP and if yes what the reason could be.

                                            E 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.