Reflection attacks of 50-70 Gbps are easily blocked by the firewall as the port is likely blocked.
These typically use PHP scripts/perl scripts/whatever and fork off in the background to do some mix of sshing into some machines legitimately purchased or with stolen cards at crappy "offshore" providers that allow spoofing or otherwise to launch reflected DNS/NTP attacks, hitting upstream APIs that do the same (as a reseller of attacks), hitting uploaded webshells to do `fsockopen('udp://'...` on a ton of cheap shared hosting machines or hacked sites, usually old PHP CMS type stuff.
Comes complete with fake "terms of service" like how it's only meant to be used for legal testing of your own servers, but in practice that's effectively there as a joke.
There's a huge market of these, "step by step" guides on youtube with affiliate links to these services, like https://www.youtube.com/watch?v=tHKBZr00IOA for example.