I now see how and where post it
I have Fiber or xDSL line > RB3011 (NAT/masquerade) > Ubiquiti CPE with no problem with NAT for DVRs, hAP lite port 80. Only port 8291 for winbox it seems impossible to access from external. I am sure, based on tests, that it's Ubiquiti that stops it, but WHY? HAP ports setup is OK also because as default. Winbox and hAP FW last versions. Where is the stop then? P.S: if on CPE is setup DMZ to hAP Winbox can reach it! Thanks to all