Aqara Home shows Network-1001

[JohnD]

Hi, you are definitely not alone with this issue! Another user from Germany is experiencing essentially the same problem when accessing the European Aqara server cluster via Starlink.

German region servers (rpc-ger.aqara.com) unreachable from Starlink connections — TCP 443 timeout, reproducible

I am unable to log in to the Aqara Home iOS app over my home internet connection. The app returns: Network error. Please try again. (Network–1001) The same app on the same phone works normally over cellular data. This is not an app, account, or device issue — I have isolated it to network reachability of your German region servers, and I can reproduce it consistently. Summary Your German region endpoints resolve correctly but do not accept TCP connections from my Starlink internet connection…

The behavior suggests that Tencent Cloud may be applying some form of automated security filtering (such as WAF, DDoS mitigation, IP reputation filtering, or other access-control policies) to certain Starlink CGNAT public IPv4 addresses.

This would explain why switching to Polkomtel LTE immediately restores connectivity for the hubs. Interestingly, Cloudflare WARP also allows the Aqara Home app to work over the Starlink connection, but the hubs themselves remain offline because they continue to use the Starlink CGNAT public IP rather than the VPN tunnel. That behavior is also consistent with the issue being related to the source IP address rather than a general routing problem.

I also did some additional testing on Starlink connections and found that another Starlink public IP can establish a TCP connection to rpc-ger.aqara.com without any issues. This suggests that the problem is not a general routing or peering issue between Starlink and Tencent Cloud, but may instead depend on the specific public Starlink IP address assigned to the customer.

You mentioned restarting Starlink. Did your public IPv4 address actually change afterwards? Starlink’s CGNAT assignments can be quite sticky, so it’s possible that you were assigned the same public IP address again (or another address that is treated the same way).

To help Aqara Support investigate, you can generate a diagnostic log directly in the Aqara Home app:

1. Go to Profile → Help & Feedback.
2. Tap the icon in the top-right corner (the document with the upward arrow).
3. Agree to generate the diagnostic logs.
4. Tap Generate log, then Copy.

It’s probably best not to post the entire log here. I would recommend sending the log directly to Aqara Support. It would also be helpful to include your current public IPv4 address (which you can check it via any “what is my IP” website) and ask them something like:

“Could you please check your Tencent Cloud security logs (WAF, firewall, DDoS mitigation, IP reputation filtering, etc.) for any filtering affecting Starlink CGNAT public IPv4 addresses? Our TCP traffic consistently reaches the Tencent network, but connections to rpc-ger.aqara.com cannot be established from certain Starlink public IPv4 addresses, while the same endpoint is immediately reachable via another Starlink public IP as well as via other ISPs.”