ECI VPN Requirement (Spruce, RockSolid MAX)

What is this?

When Margin Master pulls data directly from an ECI-hosted POS database — rather than from a local export file — the connection runs over a site-to-site VPN tunnel between the store and ECI. ECI requires this VPN tunnel for Margin Master to reach the database, and there are no work-arounds: without an active tunnel, Margin Master cannot connect, no matter how the credentials are configured.

This requirement comes from ECI Solutions (the vendor behind Spruce and RockSolid MAX) and is enforced on their side.

Before you buy hardware — ECI is migrating its hosting (as of August 2026). ECI has said they are mid-migration to a new AWS-hosted platform, that any cross-site connection configured today would be temporary and need rework within roughly three to four months as IP addresses and connection details change, and that they expect the new infrastructure to be in place by the end of September 2026. Confirm your site's migration timing with ECI before purchasing a firewall. If you need Margin Master running now, building the tunnel still works today — see Should we still build the tunnel? below.

Which POS connections require the VPN?

The VPN tunnel is required whenever Margin Master connects to an ECI-hosted SQL database over the network:

If your POS system delivers data as a local export file instead of a live database connection, you do not need the VPN tunnel. The requirement applies only to direct, network database connections to ECI-hosted systems.

What the store needs

Setting up the VPN tunnel is the responsibility of an IT specialist at the store. ECI establishes the tunnel on their side and supplies the configuration parameters, but ECI does not configure the store's network equipment. You will need:

1. A static WAN IP address. Your internet service provider supplies this. You can confirm the current address at whatismyip.com. ECI uses it to build your side of the tunnel, so it must be in hand before anything else can happen.
2. Your local subnet. Run ipconfig at a command prompt on a machine on the store network. ECI needs this together with the WAN IP — they use it to see whether your LAN range collides with the range they assign on their side.
3. A firewall that supports IPSec site-to-site VPN with NAT over the tunnel. This is ECI's stated requirement, and it is stricter than simply "a firewall that does VPN" — the device has to perform Network Address Translation across the tunnel, not just establish one. ECI names the following (see Estimated hardware costs below for pricing and product links):
   • Fortinet FortiGate
   • SonicWall
   • Sophos
   • pfSense (Netgate)
4. The configuration parameters ECI returns. Once you send the WAN IP and local subnet, ECI Support forwards them to ECI's Corporate IT Group, who send back the parameters your IT professional builds the client-side tunnel against.
5. Valid database credentials. ECI provides the database server address, username, and password separately. These are entered into Margin Master's connection settings (see below). Note that valid credentials alone are not enough — the tunnel must be active for them to work.

Setup process

1. Collect both pieces of network information: your static WAN IP address (from whatismyip.com or your ISP) and your local subnet (from ipconfig at a command prompt).
2. Send both to ECI Support and request a hosted VPN connection. Send them together — see the tip below.
3. ECI Support forwards them to ECI's Corporate IT Group, who return the required configuration parameters for the tunnel. Use the checklist in Questions to send ECI to get everything your IT professional needs in one exchange.
4. Your local IT professional builds the client-side tunnel from those parameters, on a firewall that supports IPSec site-to-site with NAT over the tunnel.
5. Confirm the tunnel is up and passing traffic. ECI cannot complete the connection until the tunnel is active.
6. Get the database credentials from ECI: SQL Server address, username, and password. The server address will be an ECI-side private address (for example something in the 10.x.x.x range) that is only reachable through the tunnel — it is not a public address you can test from the open internet. Usernames follow a SpruceUser_<StoreName>_<AccountNumber> shape.
7. Enter them in Margin Master under Options > Spruce/RockSolid: fill in Host/IP:, Database:, Username:, and Password:, tick Use IP Address when ECI gave you an address rather than a host name, then press Test.
8. Run the import. Once the tunnel is live and the Test succeeds, Margin Master can sync data.

Questions to send ECI before your IT builds the tunnel

Your IT professional cannot build the tunnel from the WAN IP alone — they need ECI's side of the specification. Only ECI can answer the questions below; the Margin Master team does not set or control any of these values. Sending all six in one message is the difference between a one-week setup and a one-month setup.

Copy and send the following:

1. Is NAT over the tunnel mandatory in all cases, or only when our LAN overlaps the range you assign? If there is no collision, can we run a plain tunnel with no translation?
2. If NAT is required, which side performs it? Are we expected to source-NAT our LAN into a subnet you assign?
3. Is your end policy-based or route-based? And is it Main Mode or Aggressive Mode? Some gateways support only policy-based IPSec in Main Mode, so we need to know before selecting hardware.
4. Does the tunnel need to carry our whole LAN, or only the one host running Margin Master?
5. Do we need a static public IP on our side, or can our side initiate outbound?
6. What is the assigned subnet, and what are your Phase 1 / Phase 2 proposals? (Encryption, hash, DH group, lifetimes, PFS.)

What ECI Connect may change

Alongside the hosting migration, ECI has described a service called ECI Connect: near-real-time access to Spruce data across locations, which they say replaces the linked-server approach and removes the need to maintain point-to-point SQL connections between sites.

The Margin Master team has not evaluated ECI Connect and does not yet know whether it provides the database access Margin Master's Spruce import needs. Margin Master reads the vw_MarginMaster view over a direct SQL connection; whether ECI Connect exposes that same access is an open question only ECI can answer.

Two things worth doing:

• If ECI discusses ECI Connect with you, tell Margin Master support what they say. It directly affects how Margin Master will connect to Spruce after your site migrates, and we would rather learn it early than at cutover.
• If you want an earlier migration slot, ask your ECI Support case to connect you with the product managers leading the effort — ECI has said stores can be considered for one.

Estimated hardware costs

The firewall is the only real expense for the VPN, and it's a one-time purchase. The prices below are rough estimates for a single-site entry-level appliance as of July 2026. Street prices vary by reseller, region, and bundle, so treat these as a starting point rather than a quote.

Lowest-cost option: A Netgate appliance running pfSense handles the tunnel for under $270 with no annual subscription. The tunnel itself doesn't require the paid threat-protection services the other brands bundle, so unless the store wants those broader security features, pfSense covers exactly what this connection needs.

Check the firewall before you buy

ECI's requirement is IPSec site-to-site plus NAT over the tunnel. Confirm any device you're considering does both before purchasing.

Consumer and prosumer all-in-one gateways — a UniFi Dream Machine (UDM / UDM-Pro), for example — are not on ECI's supported list, and some of them support only policy-based IPSec in Main Mode. If you already own one, ask ECI question 3 from the checklist above before you commit to the build; you may need to add a supported firewall anyway.

The four brands in the table above are the ones ECI names. Choosing one of them removes a whole class of compatibility argument from the setup.

On the hosting migration: the firewall is yours and keeps its value through it. What ECI says will change is the tunnel configuration and the server address — reconfiguration work, not a second purchase. Weigh a few hours of rework against getting Margin Master running now.

Tips

The VPN tunnel is a hard requirement set by ECI. If the tunnel is not up, Margin Master cannot connect even with correct, valid credentials — so confirm the tunnel before troubleshooting Margin Master settings.

Send the WAN IP and the local subnet together in your first message to ECI. Sending only the WAN IP guarantees a round-trip, and each round-trip through ECI Support to their Corporate IT Group adds days.

Send that information in writing on the case thread, and keep a copy. On at least one case, ECI stated they never received the network details while the store believed they had been sent — and a month passed with each side waiting on the other. A written record on the case thread ends that argument before it starts.

ECI's role is limited to establishing the tunnel on their side and providing the configuration parameters. Configuring the store's firewall and network is the store's IT responsibility — ECI cannot do this for you.

If ECI's support portal won't send a password-reset email, reply directly on the existing case email thread instead. ECI's case-closure notices explicitly invite a reply to re-engage on the issue, and that path works even when portal access does not. Stores have lost weeks waiting on reset emails that never arrived.

Common Questions

Q: ECI says they're migrating to AWS and our tunnel would be temporary. Should we still build it? A: It depends on how soon you need Margin Master. The firewall itself isn't wasted — it stays yours either way. What ECI says will change is the tunnel configuration and the server address, which is reconfiguration work, not a second purchase. If you need pricing data now, build it. If you can wait and your site's migration is close, ask ECI for your date first.

Q: What is ECI Connect, and will it work with Margin Master? A: ECI describes it as near-real-time, cross-location access to Spruce data that replaces point-to-point SQL connections. the Margin Master team has not evaluated it and cannot yet say whether it gives Margin Master the access it needs. Ask ECI, and pass their answer along to us — see What ECI Connect may change.

Q: Can we be moved up in ECI's migration schedule? A: ECI has said stores can be considered for an earlier slot. Ask your ECI Support case to connect you with the product managers leading the effort.

Q: Margin Master can't connect to RSMax / Spruce. The credentials are correct — what's wrong? A: The most common cause is that the site does not have an active VPN tunnel to ECI. Valid credentials are necessary but not sufficient; the tunnel must be established and actively passing traffic. Confirm the tunnel status with your IT specialist before investigating Margin Master's connection settings.

Q: Is there a way to skip the VPN? A: No. ECI requires the VPN tunnel for database connections, and there are no work-arounds. Until the tunnel is established and passing traffic, the connection cannot be completed.

Q: Who sets up the VPN — Margin Master support, ECI, or us? A: Your store's IT specialist sets it up. ECI establishes the tunnel on their side and provides the configuration parameters, but ECI does not configure your firewall or network. Margin Master support configures the connection once the tunnel is active.

Q: ECI says we need NAT over the VPN tunnel. What does that mean for us? A: It means the firewall has to translate addresses across the tunnel, not merely establish one — so the device you buy must list NAT-over-VPN (sometimes called NAT-over-IPSec or VPN policy NAT) as a supported feature. The specifics of which side translates and what range you translate into are ECI's to define; ask questions 1 and 2 from the checklist above.

Q: Will our UniFi / all-in-one gateway work? A: It isn't on ECI's supported list. Some of these gateways support only policy-based IPSec in Main Mode, which may not match what ECI's end proposes. Confirm with ECI before buying — or use one of the four supported brands and avoid the question entirely.

Q: ECI gave us a 10.x.x.x server address. Is that right? A: Yes. That is an ECI-side private address, reachable only through the tunnel. It will not respond from the open internet, so a failed Test before the tunnel is up is expected and does not mean the credentials are wrong.

Q: We can't log into ECI's support portal and the password-reset email never arrives. A: Reply on the existing case email thread instead of fighting the portal. ECI's case notices state that replying to the email re-engages support on the issue.

Q: Which firewall should we buy? A: ECI supports Fortinet FortiGate, SonicWall, Sophos, and pfSense. Any of them works. If you just need the tunnel and don't already run one of these, a Netgate appliance running pfSense is the lowest-cost pick at under $270 one time with no subscription. See Estimated hardware costs for pricing and links.

Q: How much does the firewall cost? A: For a single site, roughly $190 to $600 one time depending on brand, as of July 2026. The Netgate/pfSense route is the cheapest at under $270 with no ongoing fee. The FortiGate, SonicWall, and Sophos options cost more because they bundle annual security subscriptions you don't need just to run the VPN. See Estimated hardware costs for the full breakdown and product links.

Q: What do we need to give ECI to get started? A: Two things: your static WAN IP address and your local subnet. Send both at once.

Q: Does the file-based import (e.g., RockSolid MAX Data.txt) need the VPN? A: No. The VPN requirement applies only to direct, live database connections to ECI-hosted systems. File-based imports read a local export file and do not require the tunnel.