Tried this on my guest network, just TCP and UDP protocols, exactly the same result, total network shutdown. As soon as I enabled the rule, my phone (which was connected to the guest network) said...

So, I wanted to create a simple rule to block outgoing port 53 dns traffic from my network. 1. I created a group for DNS requests 2. I then created a Gateway ACL rule to deny access LAN->WAN for all...

@EricPerl Short answer, no, you are not missing anything, using the management VLAN sucks, it's poorly supported and as you have already noticed actually makes the management of the network much more...

@Clive_A This is not mDNS, each AP sends an A and AAAA DNS request for these hostnames every 10 mins 24/7 to my DNS server, stats below

So my EAP225 Outdoor AP got a firmware update today and sure enough it's started making DNS requests from the domain eap225-outdoor

@Hank21 I use AdGuard Home. Each AP sends an A and AAAA request every 10 mins for eap225