Although the firewall protects the router from the general public interface, you should still choose to disable RouterOS products and services.The primary rule accepts packets from now set up connections, assuming They can be safe not to overload the CPU. The 2nd rule drops any packet that connection monitoring identifies as invalid. Following that