Although the firewall safeguards the router from the public interface, you may still choose to disable RouterOS providers. The initial rule accepts packets from already proven connections, assuming They can be Secure to not overload the CPU. The next rule drops any packet that relationship monito