Even though the firewall guards the router from the general public interface, you may still need to disable RouterOS products and services.The 1st rule accepts packets from previously founded connections, assuming They are really Harmless to not overload the CPU. The 2nd rule drops any packet that connection monitoring identifies as invalid. After