Trouble understanding VLANs

[nero355]

For any Accesspoint to function it does need any kind of IP Address at all

It does *not* need ... 🙂

Thnx! :)

[bloodyNetworker]

The telemetry you talk about isn't originating from the AP itself but from the clients connected to that AP (laptop, phone, pc etc.), as already pointed out. [...] Understand what an AP does. It's just a bridge to your opnsense. Make sure it's in AP Mode and not Router Mode. [...]

This goes to nero355, Patrick M. Hausen and Boxer:
It is in AP mode. I also first thought, that the AP only sets up the "bridge" and do not require IPs, but if you take a closer look at my logs you'll see I'm not lying when I'm saying that my TP-Link APs have their own IPs and THEY THEMSELVES send out telemetry. Please refer to all the pictures.
In the DNS timeline you can clearly see the orange line, which has the IP 10.0.0.48: This is the "main" TP-Link AP.
The red box marks a certain time when I was totally home alone. No devices from my family connected, only my Linux machine.
Green is localhost.
On one of the Unbound DNS report you can even see tplink domain requests coming from 10.0.0.48, I marked those with a red box as well.
Take a look on the DHCP Leases and you'll see that 10.0.0.48 is infact my TP-Link AP and both of my APs have IP addresses assigned. The main one does domain / IP telemetry requests and the second (10.0.0.56) only some IP requests.
The devices we use are infact connected to those APs, yes I get that. However each of those devices ALSO have their own IPs I can see that in DHCP Lease. My linux machine didn't make any of such requests, I checked. Those requests solely come from the APs, I can see in Unbound DNS Reports how devices, which are connected to the AP, don't make those requests at all.

If the vendor uses telemetry and you cannot opt out, I'd switch vendors. Seriously. You need to build your network from trustworthy components.

Do you have an alternative brand / products to suggest?

EDIT: I had to compress the DNS timeline (output1.png) with ffmpeg to fit it into the max. upload size of 256kb, which decreased the quality, but I think you can still see that the orange line infact represents requests from 10.0.0.48.

[Patrick M. Hausen]

Do you have an alternative brand / products to suggest?

Mikrotik.