Unless you're just opening up all the ports on your router, it should be blocking all incoming connections by default. I'd recommend doing 1:1 port mapping for the specific internal ips of your services if your router provides that capability, but at minimum just locking it down to only opening the ports required for your services should suffice.