Messages

Post #5 https://community.tp-link.com/en/home/forum/topic/214828
Apparently it's a built-in mechanism that cannot be turned off

First, let me apologise. The Tapo AP's ping those servers (reddit, netflix etc) to check the connection is still up. So sorry about questioning that. I still think that's absurd if they're in AP Mode. But it is a ping only, there's no data telemetry. You can block those pings on opnsense but the AP will show a constant red light as if network is down, even when it's up.

The telemetry you talk about isn't originating from the AP itself but from the clients connected to that AP (laptop, phone, pc etc.), as already pointed out. If you want to limit such telemetry then you can use Unbound DNSBLs or Adguard Home plugin on the main OPNsense machine (things may break and you'll need to unbreak them if you're aggressive in your blocking). You have a lot of plans with regards to your network but I think it's best to start with the easy stuff. Understand what an AP does. It's just a bridge to your opnsense. Make sure it's in AP Mode and not Router Mode. Unbound/Adguard for telemetry blocking. These are things you can do right now before you get your managed switch. :)

If it still doesn't work keep lowering your mss value until it does

Interfaces>wan

Try clamping your mss to 1492

I had similar issues with Microsoft and it's the DNSmasq RA MTU that needs to be manually set. If you use radvd instead, the issue goes away. But setting the dnsmasq RA MTU to a workable value also fixes it. As does clamping the WAN MSS value

In Reporting, Unbound shows a blocklist size from two days ago (it's updated daily). The logs show that the DNSBLs were updated but then Unbound auto restored the database after the last two updates. Maybe corruption or size issues? I don't know

Yes I see the same thing. According to the Unbound logs the blocklist are updating but then a few hours later I see this in the log -

<Database auto restore from /var/cache/unbound.duckdb for cleanup reasons in 0.44 seconds>

https://opnsense.org/roadmap/

Also, the tester defaults back to Local Database after each test. Just something to watch out for:)

Uncheck Local Database in settings>administration>authentication. No need to have both TOTP and Local DB enabled. Then test again

Firewall>Diagnostics>States>Actions>Reset state table.
That should clear them if they're already disabled

Good stuff

Disable said extensions and see if the queries stop. It's almost certain that one of them is the cause. Be careful :)