Wireless Joint

WE826 .. question is, is it a WE826T2 or WE826Q. Probably find it in the system or kernel logs. One is a Qualcomm 9537 the other is a mediatek chip. Cant recall which.

T2/T

The Q uses a Qualcomm QCA9531

Monitor, as in when connected to the router, or remotely?

There is a firewall log i believe, and rooter is openWRT based so you can pretty much install any openWRT package on it. I've never done traffic analysis myself.

It might be that the thermo is setup to be pinged externally and not as a "man on the inside", and since cellular wireless uses CGNAt, there is no public facing IP. Maybe? I'm guessing that is why one brand would work for someone and the other wouldn't?

Just spitballing.

That should help yes, but you may experience slower speeds as running a VPN on the 400MHz single core 826 router base isn't real optimal. Wireguard is lightweight, but I'm just giving you a heads up that it might be noticeable.

Make certain you get a good geographically close VPS.

I don't tihnk forwarding is useless, I would go that route and play with firewall zone settings.

What port does the Thermostat use for it's cloud connection, regardless of IP address?

Maybe open up 5671, 5672, and 443 to allow all inbound and outbound?