Polkomtel (Plus LTE) → the same TP-Link Deco → the same Aqara hubs = everything comes Online immediately
Nothing else was changed.
Cloudflare WARP also allows the Aqara Home app to work over Starlink, but the hubs remain Offline because they do not use the VPN.
Aqara Support provided the cloud endpoints used by the hubs (rpc-ger.aqara.com and coap-ger.aqara.com with their associated ports), so this appears to be a connectivity/routing issue rather than a local network configuration problem.
Hi there, it looks like you’re experiencing a support-related issue. We’ve automatically created a support ticket for you and will reach out via the forum email within the next two business days.
If other members have any suggestions or insights on this topic, feel free to share!
Hi, you are definitely not alone with this issue! Another user from Germany is experiencing essentially the same problem when accessing the European Aqara server cluster via Starlink.
The behavior suggests that Tencent Cloud may be applying some form of automated security filtering (such as WAF, DDoS mitigation, IP reputation filtering, or other access-control policies) to certain Starlink CGNAT public IPv4 addresses.
This would explain why switching to Polkomtel LTE immediately restores connectivity for the hubs. Interestingly, Cloudflare WARP also allows the Aqara Home app to work over the Starlink connection, but the hubs themselves remain offline because they continue to use the Starlink CGNAT public IP rather than the VPN tunnel. That behavior is also consistent with the issue being related to the source IP address rather than a general routing problem.
I also did some additional testing on Starlink connections and found that another Starlink public IP can establish a TCP connection to rpc-ger.aqara.com without any issues. This suggests that the problem is not a general routing or peering issue between Starlink and Tencent Cloud, but may instead depend on the specific public Starlink IP address assigned to the customer.
You mentioned restarting Starlink. Did your public IPv4 address actually change afterwards? Starlink’s CGNAT assignments can be quite sticky, so it’s possible that you were assigned the same public IP address again (or another address that is treated the same way).
To help Aqara Support investigate, you can generate a diagnostic log directly in the Aqara Home app:
Go to Profile → Help & Feedback.
Tap the icon in the top-right corner (the document with the upward arrow).
Agree to generate the diagnostic logs.
Tap Generate log, then Copy.
It’s probably best not to post the entire log here. I would recommend sending the log directly to Aqara Support. It would also be helpful to include your current public IPv4 address (which you can check it via any “what is my IP” website) and ask them something like:
“Could you please check your Tencent Cloud security logs (WAF, firewall, DDoS mitigation, IP reputation filtering, etc.) for any filtering affecting Starlink CGNAT public IPv4 addresses? Our TCP traffic consistently reaches the Tencent network, but connections to rpc-ger.aqara.com cannot be established from certain Starlink public IPv4 addresses, while the same endpoint is immediately reachable via another Starlink public IP as well as via other ISPs.”