I have no idea how your network is set up, of course, and that’s something you should keep confidential, of course, but just to share something with you regarding DDOS, I have found that Sonicwall TZ technology, with the full Gateway Security package does seem to do a pretty good job.
I don’t presume to be giving John advice (obviously he’s a master at this), just throwing something out there as a technology that I am aware of and have worked with.
As for the leftist scum who are launching the attacks, I’d rather not say what I’m thinking as it would cause my post to be deleted.
No, the DDOS protection should not be confidential. The attackers will figure out the weaknesses regardless of secrecy. As for your suggestion: https://www.sonicwall.com/support/knowledge-base/how-can-i-configure-the-sonicwall-to-mitigate-ddos-attacks/170505822443506/ that product doesn't automatically block IPs. It does allow drag and drop by country and does so some iptables command automation.
I'm sure the Robinsons are blocking syn flood. It's a one liner iptables command They are probably blocking some ranges and countries. They can spend $6 per month to get the up-to-date list of 10,000 open proxies and block those (they change continuously). They can block the abusive VPNs. especially free VPNs that don't vet their users. But they are probably also doing some dynamic IP blocking.
Products like sonicwall do not do dynamic blocking. They help with the countries and the common iptables rules, but you can easily look up those rules and put them in your iptables script.