We had a stateful WebRTC application which received some DDOS attacks. The server had 2gbits port, so any attack over 2gbits was able to make it unavailable. Afterwards we refactored the application to be stateless and now we can deploy it to any number of servers. Currently we are considering to have around 20 VPS with 1gbits ports to handle ~20gbits DDOS. But we also would like to have some protection from the VPS provider and increase our protection. What kind of/How much protection should we look for?
There are providers with auto-mitigation options but we would like to have a configurable firewall and only allow to whitelisted IPs to access our services, if possible. But we couldn't find any suitable VPS hosting for that matter. Is it because this is the wrong way of thinking when looking for VPS? (gce has that, but networking costs a lot)