That is indeed an interesting observation. I am not a network engineer so take all of the below with a handful of salt :) Can't you drop all incoming traffic o

That is indeed an interesting observation. I am not a network engineer so take all of the below with a handful of salt :) Can't you drop all incoming traffic on "protected" IPs other than that coming through known-trusted networks like CDN's one? Your networking equipment still needs to be able to handle that load as well, which is not a given. I guess DDoS attacker could fake the IP packet headers to appear as if they are coming from Cloudflare (in your case), though even then there'd be some obscurity in figuring what subnet you are allowing through. I guess CDN providers could provide a secret-key-seeded time-based (like TOTP) source network, and your firewall would let packets in by that. The benefit of this is that it is cheaper than doing full packet encryption, and probably much easier to implement in hardware/software.