There are lots of posts here about using Cloudflare. There's also X4B[1] and Cohmbaton[2] in case you're looking for a non-Cloudflare alternative. You've menti

There are lots of posts here about using Cloudflare. There's also X4B[1] and Cohmbaton[2] in case you're looking for a non-Cloudflare alternative. You've mentioned that your hosting provider has DDOS protection (which is usually Voxility[3]/Path[4]) will usually send traffic to your VPS through their scrubbing centers, taking care of the L4 attacks. Ratelimiting and aggressive caching can take care of the rest. If you're completely into this on your own, consider setting up a number of PoPs which relay traffic to your backend servers, and these PoPs should drop UDP traffic dropped the prerouting level to drop packets without high CPU consumption. There's also eBPF/XDP, but those require much more engineering work and a compatible network card that can run a eBPF program, otherwise you're still using the CPU to drop packets. [1] https://www.x4b.net https://www.x4b.net [2] https://www.combahton.net https://www.combahton.net [3] https://www.voxility.com https://www.voxility.com [4] https://path.net https://path.net