It is more common to use this when using NO-NAT, but basically, you just add rules to say what to allow in via the WAN interfaces and what to block.
Note that if you don't add any rules (like in the screen shot), everything is allowed in. Anyone will be able to access the local status page on the MX, or any service using NAT or PAT without restriction.