Even though the firewall protects the router from the public interface, you may still would like to disable RouterOS services. The primary rule accepts packets from already set up connections, assuming They are really Secure not to overload the CPU. The 2nd rule drops any packet that connection t