>>106307703
Yes, a proper actual DDoS does that.
They SYN flood you so hard that the ISP blackholes you. Not the datacenter, but the ISP of the datacenter.
I encountered this three times. The one time i contacted the support of the datacenter because of it, it was already over before they answered, so i only got a "works on my machine" back.
Those DDoS attacks are about 30 min. They do stop once you got blackholed, because they have to protect their botnet as well, and have no interest in the whole world logging them. And the blackhole can take up to half a day before it gets lifted.
The best defense against it is to have multiple IPs on the server (you usually have those anyway) and bind ssh to a fixed one, on which you block everything else.
Now you can still access the server in case of a blackhole.
Then you use this access to bind the webserver to a different remaining IP, update DNS and keep going.
You could even have a script that automatically does that.
The thing is: Are you REALLY bothered by a 15min downtime once per month?
If not, then you don't need cloudflare.
Because any other form of DDoS (and those are most) can be mitigated by nginx, fail2ban or better application code.