DDoS protection for a VPS: a practical checklist
Edge filtering is on every plan. You still hide admin ports and rate-limit the app.
Network floods are absorbed further upstream than your guest firewall. Application abuse is yours.
Keep RDP, SSH, and panels off the open internet when you can. Use keys and 2FA. Rate-limit logins. Put a CDN in front of static sites. Know how to open a ticket with timestamps if you are under a real event.
Do not run open resolvers, recursive DNS, or amplification toys. Those make you part of someone else's flood.