Even though the firewall safeguards the router from the public interface, you may still need to disable RouterOS products and services. The 1st rule accepts packets from currently proven connections, assuming They are really safe to not overload the CPU. The 2nd rule drops any packet that connect