I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack.
I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This assumes that the DNS record of the website in question points to a CDN reverse proxy of course.
Now, should I / must I have a Firewall at my orginal server that only allows connections from a CDN-related IP?
Note: In this support article, when under attack, Cloudflare suggest to change the origin IP and update some routing:
If an attacker is directly targeting your origin web server, request your hosting provider change your origin IPs and update the IP information in your Cloudflare DNS app. Confirm all possible DNS records are orange-clouded and that your name servers still point to Cloudflare (unless using a CNAME setup) before changing your origin IP.
Why do they not recommend using a Firewall? Now, their solution will have a short term effect, but can be circumvented easily.
Is changing only the IP bad advice? Am I understanding something wrong here?