Even though the firewall protects the router from the general public interface, you may still need to disable RouterOS providers. The 1st rule accepts packets from currently established connections, assuming These are safe to not overload the CPU. The second rule drops any packet that relationshi