A firewall can block unwanted traffic and still leave a business unreachable during a distributed denial-of-service (DDoS) attack. If attack traffic fills the internet connection before reaching the firewall, dropping those packets at the office cannot recover the capacity they already consumed. Protection for that bottleneck needs to operate upstream, before traffic enters the constrained link.
For IT directors and MSPs, the useful buying question is where each protection takes effect. A gateway's DDoS feature, an internet provider's mitigation service, and application controls address different resources. Start by identifying what could run out of capacity and who can act there.
Follow the traffic to the first bottleneck
Consider a hypothetical office that hosts a customer portal behind a managed firewall. The portal and employees share one internet circuit. During a large incoming traffic flood, the firewall may continue rejecting unwanted packets while customers cannot load the portal and staff struggle to use cloud applications.
The critical distinction is location: filtering happens after the shared circuit has carried the traffic. Replacing the firewall with a faster model may improve processing capacity at the office, but it does not enlarge or clear the upstream connection. The same reasoning applies when evaluating a hosting provider's network boundary.
The UK's National Cyber Security Centre explains that network links, computing resources, and storage can each become exhausted. It also notes that services sharing a link can affect one another and that an overloaded management path can prevent administrators from reaching systems. These are separate dependencies to map before an incident.
Match the response to the resource under pressure
A service outage alone does not establish a DDoS attack. Legitimate demand, an application fault, or a routing problem can produce similar symptoms. The NCSC's response guidance recommends interpreting traffic and system measurements before choosing a defense.
| Observed pressure | Evidence to compare | Response to evaluate |
|---|---|---|
| The internet circuit is saturated | Provider-side utilization, traffic patterns, and delivery loss | Filtering or traffic cleaning before the constrained connection |
| The gateway struggles while bandwidth remains available | Packet and connection rates, device resource use, and security events | Gateway protections, policy, capacity, and upstream assistance |
| The application is overloaded | Request patterns, response times, server load, and database activity | Application-aware filtering, rate limits, and application capacity |
This table is a starting point for investigation, not a diagnosis. More than one resource can be under pressure. Pair the gateway view with provider and application evidence so that a local dashboard does not become the only account of the outage.
Make upstream protection a defined service
The NCSC's upstream defense guidance describes ISP filtering and packet-scrubbing services, which attempt to separate unwanted traffic from traffic that should continue to the customer. Providers differ in their capabilities and commercial terms.
Before relying on that coverage, establish which public addresses and services are protected, where traffic is filtered, and which attack types the arrangement addresses. Confirm whether mitigation is always active or requires an authorized request, how activation works, and what the provider commits to during that transition.
Also establish what happens when the provider protects its wider network by restricting your service. Discarding all traffic to an affected destination may contain the wider impact while leaving that destination unavailable. The recovery procedure, notification path, and any additional charges belong in the discussion alongside the protection itself.
Keep application protection in its proper place
A web application firewall can help govern requests to a web application. Its deployment location matters: a control behind an already saturated connection faces the same delivery constraint. An upstream web service may offer additional capacity and filtering, but its coverage must be confirmed for the actual application and traffic path.
Check separately whether a proposal covers a public website, remote-access services, or an entire network connection. A website-focused service should not be assumed to protect every other service sharing the organization's internet access.
Bring the network boundary into the review
Network Box USA's Unified Threat Management service includes managed firewall and intrusion prevention controls and Layer 3 DDoS protection. The agreed deployment and service scope determine where those controls operate. Review upstream capacity and ISP responsibilities alongside the managed gateway.
For a discussion of your gateway, internet connections, and the handoff between providers, contact our team.