Even though the firewall protects the router from the general public interface, you should still would like to disable RouterOS products and services. The primary rule accepts packets from currently founded connections, assuming They may be safe to not overload the CPU. The 2nd rule drops any pac