Just drop all inbound and access your home network behind a vpn remotely for the ultimate protection, not perfect, but far more secure. And monitor at the DNS level, or have a service running to monitor network activity on the terminals.

I have a Mikrotik at my home too. Beside securing the device, I suggest to filter and logs all the DNS queries and to export netflows and firewall logs somewhere (ELK or clickhouse).