Would you need an internal, external and a host-resident firewall for each POS client?
You have multiple areas of concern with DOS/DDOS attacks. If they are external they can fill up the "pipe" in your ISP before they ever reach you. That means that nothing on the inside (internal firewalls, layer 7, blackholes) will prevent packet loss before you even are reached. In order to mitigate this you need to contact your ISP and they will have protections (Kona being Akamai's; there are others).
Internally, a layer 7 firewall should have protections against this. Most layer 7's work with "DPI" and "stateful" detection which means that if you're getting a packet that doesn't make sense for the communication flow, it will be blocked. It will also cut connections for slow loris and other common attacks.
How does your small subnet use the internet? What are you required to allow in? Can you set this up in "proxy half open" which means that anything is allowed out to start a connection, but all incoming connection requests are blocked? That alone should solve this problem so long as the packet flood isn't more than your ISP "pipeline."