Even though the firewall shields the router from the public interface, you should still want to disable RouterOS providers. The initial rule accepts packets from already recognized connections, assuming They may be Harmless not to overload the CPU. The second rule drops any packet that link monit