Even though the firewall shields the router from the public interface, you should still want to disable RouterOS solutions. The initial rule accepts packets from by now established connections, assuming they are Harmless to not overload the CPU. The next rule drops any packet that link monitoring