[nullrouted]

Cloudflare is a WAF/Proxy that can handle DDoS, it isn't a DDoS specific product. If your actual network space is getting hit (e.g. 8.8.8.8) cloudflare will not help you.

[snowwrestler]

Set your network firewall to drop all packets not originating from Cloudflare's IP blocks?

[paulfurtado]

Depends on the type of DDoS. Traffic may saturate your internet connection regardless of there being a firewall on your end. In which case you need a provider capable of handling the full bandwidth of the DDoS sitting in front of you.