Please implement some functional DDOS protection finally.
Example ...
Let players to log in with catchpa on web and whitelist their public IP for 5-10 minutes for login to server and than extend this whitelisting until player disconnects, all other traffic not whitelisted should be dropped on proxy ...