i just depends on waf, as long as the ddos attack does not reach my server. is that ok?