I am simulating a service degradation attack from a remote pc to mikrotik with the TFGEN tool. Indeed in the interface I can see the traffic generated. The thing is, I can’t stop it with any firewall rule on the input chain. Any suggestion?
You cannot stop the incoming traffic from reaching your router interface by any firewall rule - the packet must first arrive so that the firewall rule could see it. /tool sniffer and /tool torch show you the actual traffic on the interface, before the firewall rules in the wire → silicon direction, and after the firewall rules in the silicon → wire direction.
What you can use the firewall rules for is to prevent the traffic from reaching devices in your LAN and processes on your router.