Although the firewall safeguards the router from the public interface, you should still need to disable RouterOS companies. The 1st rule accepts packets from by now recognized connections, assuming These are Safe and sound not to overload the CPU. The second rule drops any packet that connection