@nazuro
Why are you using VLAN 11? Here, my main LAN & SSID are untagged, native. My guest Wifi is on VLAN 3. This means I configure VLAN 3 on pfsense, my AP and switch ports connected to pfsense and my AP. That's all it takes. Only use the VLANs to add additional SSIDs. And when you do that use the same VLAN ID all the way.