can someone explain how this is done, please?
Yes, “drop all” at the end of the firewall input chain (prevent any service to be discovered from ISP/Internet)
and change MAC address of interface where ISP is connected.
That’s all “Drop all” and it’s all good
Can you write the chain for me, please?
so I just need to put DROP ALL in the last number in the firewall rule?
To all the people asking questions, do not modify or change firewall rules unless you know what you are doing!
Simply adding a block rule to your config, on the input chain, could easily lock yourself out of the router.
Ensure you have access as an admin in a higher up (in order) input chain rule
Not exactly locked out… it is still possible to use winbox via MAC Winbox Server on LAN, if the user hasn’t followed someone’s “suggestion” to disable it…
Or simply enable safe-mode before do anything…
and I will add, also use safe button, just in case
and use safe mode, if is not already writed on previous two posts…
It looks like a button 
…
What do you mean by hide Mikrotik from ISP?
I thought those proposed drop rules were already there by default..