Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ecobee thermostat can’t connect to servers

    Scheduled Pinned Locked Moved General pfSense Questions
    103 Posts 10 Posters 3.6k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      ezhawk @johnpoz
      last edited by

      @johnpoz pretty easy. when the connection is behind a Cisco device it connects just fine and stays connected for the multiple months i had it connected.. when it is behind the pfSense it can't connect or loses connectivity within days and won't ever restore.

      Common sense is the only thing that is different between the two is the introduction of the pfSense. There is something with the pfSense that is preventing connectivity.

      johnpozJ patient0P 2 Replies Last reply Reply Quote 0
      • johnpozJ Online
        johnpoz LAYER 8 Global Moderator @ezhawk
        last edited by johnpoz

        @ezhawk so your public IP is the same? How is it preventing connectivity - in your capture they send you a fin,ack.. This not preventing connectivity..

        Pfsense not sending on something would be preventing connectivity - but if your talking to the device and they send you a fin,ack - they are saying they don't want to talk to you any more.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

        E 1 Reply Last reply Reply Quote 0
        • patient0P Offline
          patient0 @ezhawk
          last edited by

          @ezhawk is there a way to provoke a connection to the Ecobee server on purpose, something that could be tried while on the Cisco and once while on pfSense (when it's not working). Capture both traffics and see what the difference is?

          Maybe the Cisco router prevented the Ecobee from e.g. making too many connection in a short time and pfSense doesn't.

          1 Reply Last reply Reply Quote 0
          • E Offline
            ezhawk @johnpoz
            last edited by

            @johnpoz
            Here we go again. Let's rehash everything in this thread already
            Ecobee behind pfSense doesn't work. No server connectivity. I spoof my WAN mac to get a new IP. Connection works for 1-14 days and then connection fails and it will never restore. We have done pcaps, both wan and lan side. When ecobee is connected to Cisco it will remain connected for MONTHS, no drops and no issues. put traffic back on the pfSense and will work for 1-14 days before dropping again and will NOT reconnect. I've gone through the mac spoofing no less than 6 times and it has behaved the same every single time. If it were the WAN IP getting black listed, explain why it only gets black listed when connected to pfSense and never gets black listed connected to Cisco?

            Pretty clear cut the introduction of the pfSense is the change that causes the failure.

            If you can tell me why when my internet path is 100% the same from Cisco or the pfSense and the connection ONLY fails on pfSense that the issue is not the pfSense I'm all ears. But I don't see any logic that can point to anything but the pfSense.

            @patient0
            i only introduced the Cisco after having to do repeated IP changes on the pfSense to restore connectivity. so, instead of always changing IPs i stood up a second egress device to specifically send the ecobee traffic around the pfSense so I can keep connection working. I also did it as a PoC to show the pfSense is the source of the problem.

            patient0P 1 Reply Last reply Reply Quote 0
            • patient0P Offline
              patient0 @ezhawk
              last edited by

              @ezhawk said in Ecobee thermostat can’t connect to servers:

              i only introduced the Cisco after having to do repeated IP changes...

              I understand and I read through this thread. I understand or assume that it is frustrating.
              Different router OS's behave different, maybe one has a fix for something that another hasn't. Just to be clear, I don't doubt that pfSense makes Ecobee behave as it is. If stephenw10 or johnpoz can't find the source with package capture, it has to be a sneaky issue/bug.

              Since it seems complicated to find the source of the issue, trying to replicate a defined situation where it works on device A but not device B seemed an approach worth considering (at least for software projects that's what you would do).

              Another thing I'd try is sending a support request to Ecobee to clarify if they rate-limit or block your IP and if yes what the reason could be.

              E 1 Reply Last reply Reply Quote 1
              • E Offline
                ezhawk @patient0
                last edited by

                @patient0

                @patient0 said in Ecobee thermostat can’t connect to servers:

                Since it seems complicated to find the source of the issue, trying to replicate a defined situation where it works on device A but not device B seemed an approach worth considering (at least for software projects that's what you would do).

                This is exactly what I have. I have the Cisco and pfSense both up. Right now, I send traffic to Cisco everything works no issues, I send traffic to pfSense and it is failure. I have a very defined situation that is repeatable and illustrates the issues.

                patient0P GPz1100G 2 Replies Last reply Reply Quote 0
                • patient0P Offline
                  patient0 @ezhawk
                  last edited by

                  @ezhawk said in Ecobee thermostat can’t connect to servers:

                  I have a very defined situation that is repeatable and illustrates the issues.

                  :) that is of course not what I meant. It has to be an action that can be triggered behind the routers.

                  If someone tell me that they run a picture through a filter in Adobe Photoshop and the same picture through a corresponding filter in GIMP, but the filter in GIMP doesn't behave the way you want. Here the picture is a clearly defined data source. Something similar in form of an Ecobee action that triggers a defined package flow would help, that is what I had in mind.

                  1 Reply Last reply Reply Quote 0
                  • GPz1100G Offline
                    GPz1100 @ezhawk
                    last edited by

                    @ezhawk Might help to identify what the Cisco router is?

                    Reaching out to ecobee is not a bad idea either. If the device has not been rebooted, they should be able to see past logs which may contain insights into the issue.

                    It's very important you provide them with incident time stamps. Asking for escalation to tier 2 may also help as this issue is indeed quite bizarre.

                    Technically both pfsense and other devices adhere to rfc standards, but im confident there's nuanced differences in implementation.

                    For those of us here it would also help to have a clear topology of your network hardware. From the above, im not clear if pfsense is out of the loop entirely when the cisco device is present.

                    E 1 Reply Last reply Reply Quote 0
                    • E Offline
                      ezhawk @GPz1100
                      last edited by

                      @GPz1100
                      Really simple but this is Topo. I have to reboot the Ecobee to get it to switch paths. Same internal subnet, but I use a different default gateway for the IP on the Cisco to send traffic out via the Cisco. All my network traffic other than the Ecobee goes through pfSense and I don't have any issues with anything.

                      Both Layer 3's links are Layer 3 on the pfSense and Cisco, so it isn't something like a loop taking place. The Cisco was only added after months of trying to figure out why the pfSense is blocking.

                      604e9ead-f272-475c-9cd4-d27100973e38-image.png

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ Online
                        johnpoz LAYER 8 Global Moderator @ezhawk
                        last edited by

                        @ezhawk so where you say "modem" you actually mean gateway.. Because if that was an actual modem.. Traffic out of pfsense to the internet would have a different public IP then traffic flowing through the cisco.

                        Either your natting these connections at your "modem" (so its not a modem) so you only have 1 public IP seen by the internet or your isp is providing you with multiple public IPs.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                        E 1 Reply Last reply Reply Quote 0
                        • E Offline
                          ezhawk @johnpoz
                          last edited by

                          @johnpoz
                          It is just a dumb standard ISP D3.1 cable modem that is baselined so it does nothing. Both my pfSense and Cisco have their OWN UNIQUE public IP. NAT is taking place on the pfSense and Cisco respectively.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ Online
                            johnpoz LAYER 8 Global Moderator @ezhawk
                            last edited by johnpoz

                            @ezhawk said in Ecobee thermostat can’t connect to servers:

                            Both my pfSense and Cisco have their OWN UNIQUE public IP

                            And that was my point a while back.. But you dismissed it saying the path is the same - when clearly its NOT!

                            If you can tell me why when my internet path is 100% the same from Cisco or the pfSense

                            Clearly that is not the case if your public IP that ecobee sees is different..

                            My point is ecobee server(s) sending you a fin,ack has nothing to do with what pfsense could be or not doing to the traffic.. They clearly said hey buddy I am done with this conversation.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                            E 1 Reply Last reply Reply Quote 0
                            • E Offline
                              ezhawk @johnpoz
                              last edited by

                              @johnpoz If you want to blame the IP, then you need to explain to me why when the Ecobee goes through the Cisco it can work perfectly for months at a time without a single issue on the same IP. But when traffic for the Ecobee goes out via the pfSense the bast case is it'll work for 1-14 days then just stop. Traffic will restore if I spoof a new mac on the pfSense to get a new IP and then it'll work for 1-14 days and then stop working again. 100% repeatable.

                              Please explain in specific detail how the specific digits of the IP address that are different between the pfSense and the Cisco are causing traffic to fail. Even more so, the IP the Cisco gets is literally 1 digit away from the one the pfSense has.

                              Please explain how because IP x is on the pfSense it has issues working with this specific thing while IP y on the Cisco doesn't. And before you tell me they are in different subnets, one is the .128 and one is the .129 in a /22.

                              Here, I'll even give you what we all know Ecobee would say to start with. "Your connection works on the Cisco router, but doesn't on the pfSense? That seems to be an issue with how the pfSense is processing traffic since you can connect via Cisco and never have an issue. We would recommend working with pfSense. If you couldn't connect with both routers then it could be a device or server issue."

                              If the convo between Ecobee Servers and my Ecobee can complete without issue on the Cisco. Why does it fail on the pfSense? The communication from my Ecobee to the servers goes to the same destination every single time. If it is the source IP, then why when the source is the Cisco router does it work for months. but if the source is from the pfSense it'll work initially, then fail and won't be able to restore? I've had multiple diff IPs on the pfSense over time via spoofing a new mac. It is the same thing over and over and over. Works for a bit then fails. I've never not once had communication fail on the Cisco and my Cisco has had the same public IP the entire time.

                              No matter what I do, the only thing that can get the connection to fail is the introduction of the pfSense into the routing path.

                              There is something that gets completely torn down on the pfSense when a new public IP is received but after a bit becomes stale or hung and isn't getting updated properly. Or the pfSense itself is doing something to the traffic. that is causing it to fail.

                              J 1 Reply Last reply Reply Quote 0
                              • J Offline
                                jrey @ezhawk
                                last edited by

                                @ezhawk

                                out of curiosity have you checked with ecobee ?

                                "ecobee has determined that a very small percentage of Smart Thermostats may experience difficulty connecting to our servers, leading to disconnection issues. If your thermostat has exhibited this problem, please use the serial number checker below to see if your device qualifies for our Connectivity Support Program."

                                maybe you have and I just missed the reference or mention in this thread

                                here is the link to check your serial number

                                https://support.ecobee.com/s/esp/smart-thermostat-connectivity-issues

                                E 1 Reply Last reply Reply Quote 1
                                • E Offline
                                  ezhawk @jrey
                                  last edited by

                                  @jrey said in Ecobee thermostat can’t connect to servers:

                                  https://support.ecobee.com/s/esp/smart-thermostat-connectivity-issues

                                  That's no longer a thing anymore according to Ecobee.

                                  And to no one's surprise, Ecobee says it is a problem with the pfSense since everything works fine when the pfSense is bypassed. They could see everything just fine until the pfSense was put in line.

                                  bf6e6cba-8ac0-4f69-928b-2909636aa7d3-image.png

                                  69f26b71-703d-4b6a-b7ce-6769e7606e36-image.png

                                  73fec4fe-74da-4201-9ea1-921a6547c3b9-image.png

                                  patient0P 1 Reply Last reply Reply Quote 0
                                  • patient0P Offline
                                    patient0 @ezhawk
                                    last edited by patient0

                                    @ezhawk said in Ecobee thermostat can’t connect to servers:

                                    And to no one's surprise, Ecobee says it is a problem with the pfSense

                                    Just to be clear (and I leave it after that), my suggestion to contact support was not to blame them but get help from them, getting information about connection made by pfSense and if Ecobee was blocking that connection at some point. I suspect you won't get that info in a chat from a 1st level support.

                                    Your package capture shows a 'Client Hello' from the Ecobee device when connecting to idt.ecobee.com and in a normal conversation, the answer would be a 'Server Hello' from the Ecobee server. But instead Ecobee ends the connection (the connection to home-fw.ecobee.com get a 'Server Hello', seems successful).

                                    1 Reply Last reply Reply Quote 0
                                    • A Offline
                                      akochetkov
                                      last edited by

                                      I am sorry to chime in. By any chance, do you have a process set up on pfsense that periodically and with reasonably high rate sends packets to Ecobee servers? For example, (and only for example) if you have configured Ecobee server IP address for Gateway monitoring purpose in pfSense, then by default pfSense sends ICMP echo requests to that address every 0.5 second. That stream of packets could be enough for Ecobee server to declare DoS attack and blacklist your IP address.

                                      You may want to capture all traffic between pfSense and Ecobee server IP address on WAN interface to check for that.

                                      This may lead nowhere, but it is worth to check, in my opinion.

                                      I do have Ecobee-3 thermostats and I use pfSense (Netgate 4200) and I never had any problem.

                                      E 1 Reply Last reply Reply Quote 0
                                      • E Offline
                                        ezhawk @akochetkov
                                        last edited by

                                        @akochetkov
                                        No, I don't have any process or service on pfSense set up to monitor the Ecobee IPs. There is a pcap earlier in the thread that I pcap'd my WAN to the Ecobee subnet. And even when the Ecobee can't connect to the Ecobee servers, it can still ping Ecobee.com.

                                        johnpozJ GPz1100G 2 Replies Last reply Reply Quote 0
                                        • johnpozJ Online
                                          johnpoz LAYER 8 Global Moderator @ezhawk
                                          last edited by

                                          @ezhawk said in Ecobee thermostat can’t connect to servers:

                                          And even when the Ecobee can't connect to the Ecobee servers,

                                          where did you show this - what you showed was them sending you a fin,ack - this is clearly connecting to what you posted.. If there is something that you can not actually connect to you have not shown that.. Where is the traffic you see hit pfsense lan but not get sent out the wan.

                                          What exactly do you think pfsense could do to the encrypted traffic via a https tunnel, that would force them to send you a fin,ack?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                                          1 Reply Last reply Reply Quote 0
                                          • GPz1100G Offline
                                            GPz1100 @ezhawk
                                            last edited by

                                            @ezhawk I think you need to make the pfsense/cisco comparison be more apples to apples. That is, your entire network should be behind the cisco router while the ecobee is connected. Otherwise, there may be traffic on the pfsense side that does not exist when behind the cisco.

                                            J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.