As some point I have lost the ability to connect to couple of hap ac2's from the wan side. Winbox, ping, pptp, nothing from wan side. Is there a hidden feature somewhere that blocks all connections from outside world? Not internet issue, because I cannot even ping from local pfsense server simulatin...

There is no reason to change the ddns name, since it is deriverd as:
'serial'.sn.mynetname.net where serial is the 'serial' is the serial of the device.

If you are afraid of an old user trying to access your device, you simply use firewall to keep them at bay.

Sorry, but this device is not meant to handle any tunneling and the CPU load you are experiencing is normal.
The CRS112-8G-4S is a routing capable switch, where the routing function is mainly for management purposes.

The cheapest MT device that would handle some tunneling is the RB750Gr3 ie. HEX

It seems that the newer batch of hAP lite (classics) come with bad power supplies.

I have 2 from newer batches where the PSU is 1A. (Older ones have 0.5A PSUs)
The microUSB connectors are such a bad quality that with slight movement the power is gone.
No problems with the "old" PSUs

Is there any chance of getting multicast buffering over vpn tunnels, as with wireless links. I have tied together 2 hex lites over pptp tunnel for sending a dTV multicast stream. Now the problem is that the receiver side is using LTE connection, so the stream tends to drop frames at certain times. M...

Can the block diagram be found somewhere?