cloudflare used to use iptables with SYNPROXY, simple blocking rule and later BPF matching.

Your server would be dead in any large scale attack anyway, iptables is fine and works well