Hi,
I am planning to move a house in December. The new house will have three floors with ethernet point on each. I am thinking about RB4011iGS+5HacQ2HnD-IN as main router and then I am looking for something ideally AP with MESH for the third floor. Which AP or router in AP mode will be the best for that? It will be connected via the ethernet to the main router.

Take a look at the Mikrotik Audiance
(https://mikrotik.com/product/audience)

It has 3 Wireless-Interfaces.
2.4 & 5 Ghz for Network
and a dedicated 5Ghz for Mesh or Repeater-Mode

Can it work together with RB4011iGS+5HacQ2HnD-IN and not make a double NAT? Does it support VLANs?

Every mikrotik wireless device can be configured to only act as AP (as in ethernet to wireless gateway), the rest of functions (DHCP, routing, ...) are performed by other LAN entities (e.g. main router).

Every mikrotik device running ROS (and probably SwOS, I don't have any SwOS experience) is fully capable of doing VLAN stuff.

I would strongly recommend a change in wireless vendors.

I have an Audience. It's not that good a WAP. It can do VLANs and can be configured ohh so many ways.

But its wireless performance serving client devices, is really pathetic.

I will defend Mikrotik routing...
But the wireless isn't even an "Also Ran" anymore.

Depends on budget......

1. No limit - Netgear Orbit WIFI 6E ( not yet in a wall/ceiling mount option though )
https://www.netgear.com/home/wifi/mesh/rbke963/
2. $250 - TP link 660HD
3. $180 (maybe) the new Ubiquiti WIFI U6 pro is like the TP 660HD but only $180 but requires stewpid proprietary controller software (not free).
4. $90 - TP link eap 245 v3 (but get them soon as not sure how much longer they will have this on the market ) - Performance: what the capac should have been and never will be

Got springs could fill in the cambium, Ruckus models (as they are more high end and I cannot afford them).

2. $250 - TP link 660HD
3. $180 (maybe) the new Ubiquiti WIFI U6 pro is like the TP 660HD but only $180 but requires stewpid proprietary controller software (not free).

The Ubiquiti WiFi U6 Pro can be run with a FREE controller that runs under Windows .... BUT I do not recommend this unit unless one runs the UDM-Pro in conjunction with the Ubiquiti WiFi U6 Pro or with the 2nd Gen Unifi Cloud Key .... why ? due to the AI engine that is integrated into the Unifi system ....

For the Tik user however I would highly recommend the TP link 660HD because performance is SUPERB !

I have a capac, a TPlink EAP245v3, and a TPlink 660HD in my house.
If on a budget, get the TPLINK eap245v3, one for each floor, works with vlans, decent wifi5 performance etc.
If have some flexibility get the TPLink 660HD, you will only need two of these as they penetrate through walls quite nicely.
(getting only one way may be a stretch to cover three floors, especially if you have cement floors etc, and depends upon closer inspection of requirements)
( you could do it piece by piece for example. Get one 660HD and put it on the middle floor and gauge the performance in the house).
(if not satisfactory consider putting the existing one on the first floor and a second on the third floor)

As for the router, around the same price as the rb4011 is their newer model the RB5009.
I would NOT get a wireless router.

Got springs could fill in the cambium, Ruckus models (as they are more high end and I cannot afford them).

Don't lump Cambium in there with devices I would use.

I have 2 WAPS from them and they work about as well as UniF--k with Ruckus Pricing.

Every time I start talking with a "Cambium guy" they make the product sound like its worth another look. From 2017 up till now... NOPE. The units go right back in the box on the shelf after getting their A-- kicked by whatever I am testing.

For the Tik user however I would highly recommend the TP link 660HD because performance is SUPERB !

TP-Link and Eugenius clearly went to the same OEM this time around. Looks like Emplus WAP380 is definitely the Eugenius WAP.
And the $100 cloud key...

A company I contract for is really pushing me to take another look at Engenius... "Sure... you gonna pay me to test it out?"
crickets

No key required for TPLINK

No key required for TPLINK

Just pick your flavor of Emplus CRAP.

Got springs could fill in the cambium, Ruckus models (as they are more high end and I cannot afford them).

Don't lump Cambium in there with devices I would use.

Cambium purchased Xirrus A very fine wireless system … IMO far superior to anyone else including Ruckus etc but very expensive for small deals but very cost effective for large deals especially where thousands of users are part of the makeup.

For home and SMB TP-Link 660HD performs and performs exceptionally well …. No controller is required but is available for mgmt purposes if needed. I have many in the field.

One of those difficult questions: what is the best here ... .
There is only one answer: It depends! Depends on how comfortable you are with an OS as RouterOS (as member since 2010), and what the intended use is in the next 5 years.
OP does not want double NAT, probably because gaming is important, or is it SIP needs?

What is the internet uplink, how will it evolve? Is there a mandatory ISP modem/router? What speeds should be handled?
One LAN network, many separated networks, .... ?
What has introduced the MESH solution? Is the cable from 2nd to 3th floor something complicated? MESH will be inferior to that cable. Gaming also needed on the 3th floor?

VPN's ending at any Mikrotik, one transparant L2 network over multiple AP, multiple VLAN for separation .... with RouterOS no problem at all.
ROS 6 has limited wifi performance something between 802.11n and 802.11ac. The real 802.11ac and acwave2 will only come with RouterOS 7 (currently only hAP ac3 , RB4011 5GHz, and Audience)
Depending on the RF environment (own and neighbors devices) 360 Mbps should be possible on each of the floors with ROS 6 , at least in the same room as the AP.
Additional AP could be needed, and are easy to split off from the first, on each floor, if you need the max speed everywhere. (Depending on the size of the home, and thickness of the walls)

And to compensate a bit on colleagues who find the grass greener on the other side. I have thrown all the Ruckus, Engenius, Ubiquiti, TP-link and Draytek in the trash, and replaced them with appropriate (but more) Mikrotik. Except for the main router, there are still too many application dependent settings that are too much to script Performance improvement is 20x. There were many mistakes against wifi fundamentals in the initial setup of those no-more-upgradable units, what could not be fixed. Is this MT setup good or even possible for another situation: it depends!

Haha, maybe MT wifi works for you because you have researched every scrotum hair on the testes of MT wifi in order to get it to work.
Most of us dont have the time, knowledge or patience!
I admire your skill but dont agree with your conclusion.

Mozerd
I am referring to the cambium AC wave 2 devices. An E600 and E410 have been my test units for years now.

People swore up and down they were wonderful... incredible... Better than anything else...
"You people need to get out more."

The radio performance was really really similar to UniF--k. The controller had a bunch of 1/2 baked components. But it didn't get overwhelmed and cry to Mama. It could still pass traffic... It would just have a ton of errors and slow to dirt. It also has gaps that we use all the time in our commercial jobs.

Everytime I get to talk to product development at cambium they take notes, and are "gonna get back to me." Everytime they say that... It takes months... And install a couple hundred radios from other manufactures.

Now we are back around to "hey, we really think you should take a look at our new product." It's WiFi6 and actually shipping.

EMplus, a tad more expensive than TPLINK and same size as Ubiquiti U6 Pro 8.1 inches by 8.1 inches square shape (11 inches corner to corner) vice round shape 9.6 inch radius for TPLINK.

dont agree with your conclusion.

Sorry, didn't mean to postulate any conclusion here, yet

And for sake of clarity: didn't say MT has an excellent wifi (it will NOT get you at the full 802.11ac performance), only that you can get in trouble with all wifi implementations if you violate wifi fundamentals, and implement the wrong hardware for the job, independent of how expensive it is.
If you are not ready for using a non-auto-tuning wifi (MT), then stay away of it. It will not just work well out of the box by plugging it in.
If you are ready to learn wifi rules and tune MT, it will work well in a house-hold environment, even much better than obvious wrongly choosen self-tuning hardware or setup.

TP-Link and Eugenius clearly went to the same OEM this time around. Looks like Emplus WAP380 is definitely the Eugenius WAP.

Are you thinking of the Netgear APs? They are basically the engenius APs but with less RAM.

TP-Link and Eugenius clearly went to the same OEM this time around. Looks like Emplus WAP380 is definitely the Eugenius WAP.

Are you thinking of the Netgear APs? They are basically the engenius APs but with less RAM.

I mean if you go to the FCC website... They have tear downs (internal photos) of the units. And the boards are stamped as Emplus.

I mean if you go to the FCC website... They have year downs of the units. And the boards are stamped as Emplus.

I didn't see it on the eap660HD pdfs, but the quality is not that good. The ethernet/power/reset layout on the tp-link is also different compared to the engenius/netgear models.