I think this should be changed in FW, by enabling the option to disable DNS queries, or at least change it to a simple ping.

I don't want to seem ungrateful or arrogant, but this is another reason to switch either entirely to MikroTik or Ubiquiti... there's no situation like here where we accidentally discover something is happening outside our control when installing a firewall... The same thing with the re605x, no Ethernet backhaul. You can't ask TP-Link to implement the EasyMesh controller on a device operating in AP mode, or to use the Omada hardware controller for this... if there's hardware, it's a matter of software. On the other hand, I realize that my wants are probably only 1% of my total needs.