Even though the firewall safeguards the router from the general public interface, you should still choose to disable RouterOS solutions.The first rule accepts packets from already founded connections, assuming They are really Harmless not to overload the CPU. The next rule drops any packet that connection monitoring identifies as invalid. Following