The IoT device (e.g. wifi thermostat) usually connects/calls out to a central server, using your home ISP network, and keeps this connection alive 24/7 by sending combination of ACK & SYN packets every few seconds at the TCP level. The IP address of the central server is coded into the firmware of the IoT device. The upper-layer protocol (HTTP, SSH, custom made, etc.) and encryption vary between devices/companies. Alot use SSL TLS over port 443. If you port scanned the IoT device inside your local LAN, it would show no open ports (except for maybe an admin port/webpage to change settings) If you download a mobile app onto your smartphone to control this IoT device, that smartphone app calls into (sends commands to) the same central server, and that central server relays the command back to the IoT device. A similar & simple concept/technique with good documentation is called reverse SSH tunneling or reverse SSH port forwarding.