Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ecobee thermostat can’t connect to servers

    Scheduled Pinned Locked Moved General pfSense Questions
    103 Posts 10 Posters 3.6k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J Offline
      jrey @ezhawk
      last edited by

      @ezhawk

      out of curiosity have you checked with ecobee ?

      "ecobee has determined that a very small percentage of Smart Thermostats may experience difficulty connecting to our servers, leading to disconnection issues. If your thermostat has exhibited this problem, please use the serial number checker below to see if your device qualifies for our Connectivity Support Program."

      maybe you have and I just missed the reference or mention in this thread

      here is the link to check your serial number

      https://support.ecobee.com/s/esp/smart-thermostat-connectivity-issues

      E 1 Reply Last reply Reply Quote 1
      • E Offline
        ezhawk @jrey
        last edited by

        @jrey said in Ecobee thermostat can’t connect to servers:

        https://support.ecobee.com/s/esp/smart-thermostat-connectivity-issues

        That's no longer a thing anymore according to Ecobee.

        And to no one's surprise, Ecobee says it is a problem with the pfSense since everything works fine when the pfSense is bypassed. They could see everything just fine until the pfSense was put in line.

        bf6e6cba-8ac0-4f69-928b-2909636aa7d3-image.png

        69f26b71-703d-4b6a-b7ce-6769e7606e36-image.png

        73fec4fe-74da-4201-9ea1-921a6547c3b9-image.png

        patient0P 1 Reply Last reply Reply Quote 0
        • patient0P Offline
          patient0 @ezhawk
          last edited by patient0

          @ezhawk said in Ecobee thermostat can’t connect to servers:

          And to no one's surprise, Ecobee says it is a problem with the pfSense

          Just to be clear (and I leave it after that), my suggestion to contact support was not to blame them but get help from them, getting information about connection made by pfSense and if Ecobee was blocking that connection at some point. I suspect you won't get that info in a chat from a 1st level support.

          Your package capture shows a 'Client Hello' from the Ecobee device when connecting to idt.ecobee.com and in a normal conversation, the answer would be a 'Server Hello' from the Ecobee server. But instead Ecobee ends the connection (the connection to home-fw.ecobee.com get a 'Server Hello', seems successful).

          1 Reply Last reply Reply Quote 0
          • A Offline
            akochetkov
            last edited by

            I am sorry to chime in. By any chance, do you have a process set up on pfsense that periodically and with reasonably high rate sends packets to Ecobee servers? For example, (and only for example) if you have configured Ecobee server IP address for Gateway monitoring purpose in pfSense, then by default pfSense sends ICMP echo requests to that address every 0.5 second. That stream of packets could be enough for Ecobee server to declare DoS attack and blacklist your IP address.

            You may want to capture all traffic between pfSense and Ecobee server IP address on WAN interface to check for that.

            This may lead nowhere, but it is worth to check, in my opinion.

            I do have Ecobee-3 thermostats and I use pfSense (Netgate 4200) and I never had any problem.

            E 1 Reply Last reply Reply Quote 0
            • E Offline
              ezhawk @akochetkov
              last edited by

              @akochetkov
              No, I don't have any process or service on pfSense set up to monitor the Ecobee IPs. There is a pcap earlier in the thread that I pcap'd my WAN to the Ecobee subnet. And even when the Ecobee can't connect to the Ecobee servers, it can still ping Ecobee.com.

              johnpozJ GPz1100G 2 Replies Last reply Reply Quote 0
              • johnpozJ Online
                johnpoz LAYER 8 Global Moderator @ezhawk
                last edited by

                @ezhawk said in Ecobee thermostat can’t connect to servers:

                And even when the Ecobee can't connect to the Ecobee servers,

                where did you show this - what you showed was them sending you a fin,ack - this is clearly connecting to what you posted.. If there is something that you can not actually connect to you have not shown that.. Where is the traffic you see hit pfsense lan but not get sent out the wan.

                What exactly do you think pfsense could do to the encrypted traffic via a https tunnel, that would force them to send you a fin,ack?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                1 Reply Last reply Reply Quote 0
                • GPz1100G Offline
                  GPz1100 @ezhawk
                  last edited by

                  @ezhawk I think you need to make the pfsense/cisco comparison be more apples to apples. That is, your entire network should be behind the cisco router while the ecobee is connected. Otherwise, there may be traffic on the pfsense side that does not exist when behind the cisco.

                  J 1 Reply Last reply Reply Quote 0
                  • J Offline
                    jrey @GPz1100
                    last edited by

                    @GPz1100

                    That's a great point

                    @ezhawk said in Ecobee thermostat can’t connect to servers:

                    NAT is taking place on the pfSense and Cisco respectively.

                    it's been a while since I had to play with Cisco gear, but it requires specific NAT configuration as I recall -
                    where the pfSense should just work with no special config for a device like the ecobee, maybe, however this is a case where one of the "it should just work" on pfSense needs a specific setup.

                    The reasons ecobee might be rejecting is because of the NAT setting or lack there of on pfsense ?

                    Have you configured anything specific for NAT setup on pfSense?

                    perhaps you could show us the Cisco config for this NAT ? and tell us if you are using default setting on the pfSense box or trying to follow a Cisco style and set something up ?

                    Have you simply just tried another network cable ? stranger things have been known to happen - is the cable showing you all the settings you would expect from pf to modem ?

                    As has been suggested by many - there is no obvious reason it shouldn't just work.
                    it will be the ecobee server - like every other device making the original request to a server, if they are telling you to go away (and they are) there is something about the packet they don't like.

                    Finally if you search the forum for pfSense vs Cisco you will find a number of previous threads (some really old) but you might review them anyway (if you haven't already) and see if anything stands out.

                    E 1 Reply Last reply Reply Quote 0
                    • E Offline
                      ezhawk @jrey
                      last edited by ezhawk

                      @jrey

                      @jrey said in Ecobee thermostat can’t connect to servers:

                      @GPz1100

                      I think you need to make the pfsense/cisco comparison be more apples to apples. That is, your entire network should be behind the cisco router while the ecobee is connected. Otherwise, there may be traffic on the pfsense side that does not exist when behind the cisco.

                      Already done and to no great surprise, everything works perfectly on the Cisco including the Ecobee.

                      @ezhawk said in Ecobee thermostat can’t connect to servers:

                      NAT is taking place on the pfSense and Cisco respectively.

                      The reasons ecobee might be rejecting is because of the NAT setting or lack there of on pfsense ?

                      Please provide details of what you might think this is. Even when the Ecobee can't connect to the Ecobee servers, it can ping Ecobee.com from the device itself, so NAT is working.

                      Have you configured anything specific for NAT setup on pfSense?

                      No, nothing is specifically configured. And Cisco NAT is dirt simple, all you do is define the inside and outside interface and one line for nat-overload and the ACL for internal subnets.

                      perhaps you could show us the Cisco config for this NAT ? and tell us if you are using default setting on the pfSense box or trying to follow a Cisco style and set something up ?

                      Cisco
                      !
                      interface GigabitEthernet0/0.999
                      ip nat inside
                      interface GigabitEthernet0/1
                      ip nat outside
                      !
                      ip nat translation timeout 1000
                      ip nat inside source list 101 interface GigabitEthernet0/1 overload
                      !
                      access-list 101 remark NAT_Pool_Extended
                      access-list 101 permit ip 10.0.0.0 0.0.0.255 any
                      access-list 101 permit ip 172.16.21.0 0.0.0.255 any
                      access-list 101 permit ip 10.1.0.0 0.0.0.255 any
                      access-list 101 permit tcp 10.1.0.0 0.0.0.255 any
                      access-list 101 permit ip 10.99.0.0 0.0.0.255 any
                      Nat on both is just default.

                      Have you simply just tried another network cable ? stranger things have been known to happen - is the cable showing you all the settings you would expect from pf to modem ?

                      yeah i've done all that L1 ts.

                      patient0P J 2 Replies Last reply Reply Quote 0
                      • patient0P Offline
                        patient0 @ezhawk
                        last edited by

                        @ezhawk said in Ecobee thermostat can’t connect to servers:

                        Even when the Ecobee can't connect to the Ecobee servers, it can ping Ecobee.com from the device itself

                        Your package capture show (as I mentioned in my post before) that it seems that the Ecobee can connect to fw-home.ecobee.com but idt.ecobee.com closes the connection.

                        Maybe another question: how would you like pfSense to solve it? It won't work without someone who got that issue.

                        And according to your package capture it does not affect all ecobee.com servers but the idt.ecobee.com. I think that is something to consider.

                        GPz1100G 1 Reply Last reply Reply Quote 0
                        • GPz1100G Offline
                          GPz1100 @patient0
                          last edited by GPz1100

                          @patient0 Worth exploring tunneling idt.ecobee.com (or all *.ecobee.com) traffic via a vpn. OP says he has no vpn. Cloudflare warp is free and will suit this purpose. I offered some guidance on the previous page how to set it up.

                          1 Reply Last reply Reply Quote 0
                          • J Offline
                            jrey @ezhawk
                            last edited by

                            @ezhawk said in Ecobee thermostat can’t connect to servers:

                            No, nothing is specifically configured.

                            Ok, was just curious if you have configured anything "special" under any of the 4 tabs found under Firewall -> NAT

                            seems that is not the case..

                            however also sounds like maybe the overload setting function on the cisco ?

                            There are numerous posts like this. Maybe in this case you just have to "help" pfsense build the right packet the looks correct for the ecobee server and have it stop telling you to go away ?

                            https://forum.netgate.com/topic/189729/nat-external-ip-vs-internal-ip-cisco-vs-pfsense

                            I don't have a ecobee so ... can't really see first hand what is going on out of the box so to speak ...

                            • the other option presented of using Cloudflare wrap would likely also work.
                            GPz1100G 1 Reply Last reply Reply Quote 0
                            • GPz1100G Offline
                              GPz1100 @jrey
                              last edited by GPz1100

                              @jrey I don't think this is a nat issue. It would either work or not work, but not likely be intermittent. Indeed there's some traffic ecobee server is receiving which causes it to end the connection.

                              I have the premium (and the ecobee3 lite before) with no such issues behind pfsense.

                              @ezhawk how is the ecobee wifi configured? Different vlans for different interfaces? Anything else sharing ecobee's?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S Offline
                                stephenw10 Netgate Administrator
                                last edited by

                                Does the cisco randomise the source port in NAT?

                                Perhaps Ecobee periodically does something that assumes a source port and when that fails it marks it as bad. Unlikely but easy enough to test with a static port rule.

                                Can you spoof the WAN MAC on the Cisco so it has the IP pfSense is currently using where Ecobee is failing. See if it then starts working behind the Cisco. That would prove it's not the Ecobee server blocking the IP.

                                1 Reply Last reply Reply Quote 0
                                • E Offline
                                  ezhawk
                                  last edited by

                                  @patient0

                                  @patient0 said in Ecobee thermostat can’t connect to servers:

                                  Your package capture show (as I mentioned in my post before) that it seems that the Ecobee can connect to fw-home.ecobee.com but idt.ecobee.com closes the connection.

                                  Maybe another question: how would you like pfSense to solve it? It won't work without someone who got that issue.

                                  How would I like pfSense to solve this? Pretty simple, I'd like pfSense to figure out why this works perfectly fine with a Cisco Router and fails with pfSense. But that request seems to be way too much for this board.

                                  But let's look at the facts:

                                  1. Regardless of what Public IP I get, the connection fails when going through pfSense
                                  2. Regardless of what Public IP I get, the connection works 100% of the time going through Cisco.
                                  3. The destination is the same as the Ecobee reaches out to the same servers.
                                  4. Initially, when pfSense gets a new IP the connection works for 1-14 days. The connection will then fail.
                                  5. The connection never fails going through a Cisco router.
                                  6. None of my 80+ other devices on my network have issues with connectivity to anything.
                                  7. If there was an issue on the Ecobee side, it wouldn't matter what router I'm using. I would see the same thing on both routers which is not the case.
                                  8. If the issue is with idt.ecoebee.com closing the connection, why isn't this an issue on a Cisco router?
                                  9. For those who want to blame it on Ecobee, then they also ignored, the point I made that I had the same problem with Google Nest. It worked like a charm until I put in my pfSense, then I began to have the losing connectivity every couple of weeks and a spoof the MAC to get a new public IP would get connectivity for 1-14 days before it stopped working. I thought it was Google having issues, so I went out and spent the $ to switch from Google to Ecobee and I ended up with the exact same problem.

                                  The only impactful variable between the working and non-working is the pfSense vs Cisco. I get this is a Netgate pfSense board in which no one wants to admit that there could actually be something faulty with a Netgate pfSense device.

                                  @GPz1100 said in Ecobee thermostat can’t connect to servers:

                                  @patient0 Worth exploring tunneling idt.ecobee.com (or all *.ecobee.com) traffic via a vpn. OP says he has no vpn. Cloudflare warp is free and will suit this purpose. I offered some guidance on the previous page how to set it up.

                                  Been looking to see if I can set up a workaround. But realistically it is ridiculous to have to set up a VPN and PBR because of a pfSense failure. The way everyone talks, the connection should just work. The other thing that would be stupid in this set up is not only do I have to have Internet and Ecobee servers be up for remote connection for my Ecobee, this now adds a 3rd party into it.

                                  Actually, I've had it. This board wants to blame everything other than the pfSense and I'm done. For everyone that just want to blame my network, or the Ecobee Servers, or the digits of an IP being different...congrats you win! I'll just run a second router until I can find an suitable replacement for the pfSense and then I can get the faulty device out of my network.

                                  patient0P J 2 Replies Last reply Reply Quote 0
                                  • A Offline
                                    akochetkov
                                    last edited by

                                    There might be two other differences between pfSense and Cisco configurations.

                                    1. DNS Resolver. Are pfSense and Cisco configured to use the same DNS resolver? pfSense has its own DNS Resolver. Unless it is disabled (forwarding mode) it is different than what Cisco uses. I know it is not likely but there is a chance that pfSense and Cisco resolves Ecobee Server name into different IP addresses. I am sure there is more than one Ecobee server worldwide.

                                    2. Home Assistant and Apple Home Kit. Is Ecobee thermostat connected to and communicate with them in both pfSense and Cisco cases? Although Ecobee says it is possible to use Home Kit (Home Assistant) integration and Server integration at the same time I remember reading that some people on Internet ran into a problems doing that.

                                    Maybe you have already done that but I will suggest anyway (You can ignore it if you wish) to take another Netgate device (you mentioned you have Netgate 2100 and Netgate 1100) configure it plain vanilla (mostly just factory default) isolate from rest of your network and connect the thermostats to it. Who knows it could give us additional information.

                                    patient0P 1 Reply Last reply Reply Quote 0
                                    • patient0P Offline
                                      patient0 @akochetkov
                                      last edited by

                                      @akochetkov said in Ecobee thermostat can’t connect to servers:

                                      (you mentioned you have Netgate 2100 and Netgate 1100)

                                      He's not the OP, he got a Netgate 4100.

                                      1 Reply Last reply Reply Quote 0
                                      • patient0P Offline
                                        patient0 @ezhawk
                                        last edited by

                                        @ezhawk said in Ecobee thermostat can’t connect to servers:

                                        Actually, I've had it. This board wants to blame everything other than the pfSense and I'm done

                                        Fair enough, although I never tried to blame Ecobee and I was a bit frustrated that you don't read it as I wrote it: get Ecobee involved to find out what pfSense makes behave different when connecting to idt.ecobee.com. Well, that's life guess.

                                        1 Reply Last reply Reply Quote 0
                                        • J Offline
                                          jrey @ezhawk
                                          last edited by jrey

                                          @ezhawk said in Ecobee thermostat can’t connect to servers:

                                          If the issue is with idt.ecoebee.com closing the connection, why isn't this an issue on a Cisco router?

                                          because the packet from the cisco NAT looks okay at the ecobee end

                                          because the packet from the pfsense NAT in "automatic mode" might not look okay and they reject it

                                          Several other posts and in fact other forums talk about this subject and most suggest that you may have to help the pfSense by providing either hybrid or manual configuration for this particular NAT.
                                          kind of like you do with the cisco overload line you have in the config.

                                          idt.ecobee.com. - the address actually doing the client hello is telling you to go away likely because something isn't quite right in the packet.

                                          if you scan idt.ecobee.com you will find that it allow pings, port 80 http traffic, and port 443 but there is no https response - they are running (as you would expect some other service) -- further if you attempt to do a TLS/SSL scan on the port you will be flat out told to go away. (FIN, ACK) ie your packet doesn't match what we want to see.
                                          Not seeing anyone specifically blaming ecobee. yes ecobee might have a very particular set of connection rules (they should) and clearly they do.

                                          Yes DNS does play a role here, so the other suggestions on the thread are valid.
                                          as are the questions regarding your firewall rules, any internal VPN etc.

                                          Auto NAT might not always get it right (in some cases) your particular combination of gear - the order you flow the traffic might be causing one of those "special" cases. That's not a blame game, that's fact, that's why you have options ..

                                          (ah google nest) I've never had a problem) but I have a different modem I'm sure (fibre) static IP, different access point, different managed switch and no cisco - my access point also goes directly to the one of the pfSense ports on the 2100 - My 2100 has the managed switch on 1, the main AP on 2, and a small hub with a bunch of goodies plugged in (include two additional access points in another build) on port 3 -- zero issues -- and I just realized I have an empty port I better go find something to plug in - LOL

                                          Clearly if you had problems with the nest as well, says something is wrong with that path out and back, (assuming the nest also went through the same AP, cisco switch - pfsense ) as in the diagram ...

                                          Have you tried plugging the AP directly into the pfsense and letting that run for a while ? just curious.

                                          you might have to help pfSense build the NAT for this service. Not because pfsense or ecobee or the AP or anything else is wrong or specifically broken, just because you have something special happening (the edge case the is one off)

                                          It's really kind of hard for anyone without that exact combination of gear you have to sort it out for you, when all they hear is "it is broken can you make it go". If the Cisco works and does everything you need for the 80+ devices why change anything ?

                                          Carry on

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S Offline
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            I think you may be over reacting to users questions. 😉

                                            There are plenty of things pfSense could be better at!

                                            Most commonly when we see reports of some service that worked fine behind some other router but not pfSense it's either a NAT issue or some ALG/Proxy that was present on the other device but not in pfSense.

                                            Try setting a static source port.

                                            The difficulty here is that it doesn't fail immediately. It looks as though the ecobee server marks the IP address bad in some way after some time and presumably after some conection event that pfSense fails to pass. But we have yet to see exactly what that is which makes it difficult to diagnose.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.