Yes, it's possible to DDoS even if no ports are open.
Keep in mind that a DDoS attack works by exhausting a resource. It can be processing power, storage, memory, or bandwidth. So if an attacker sends way more traffic in your way than your network can receive, your network access will be severely degraded. No matter if there's a service active to receive ...
You should definitely contact your ISP about this and let them know as this is something they should block.
Some ISP's renew the IP of the subscriber every time the router/modem resets, I recommend you try this too.
If you were connected by WiFi to the router, the attack that were surely made to you is a "client deauthentication".
That is based on sending packages so that the client disconnects from the router and losing the connection. In many cases, another point of access is usually lifted with your same network SSID network so that you connect to a malicious access ...
I'll go through the points you have mentioned, and will add some extra points below as well
WEP? WPA? WPA2?
All of these schemes have flaws, but some more than others. The current best practice is to use WPA2-Enterprise with client certificates for each individual device. This way, even a rogue device will be unable to sniff traffic of other devices.
But else what could they do to prevent this behaviour?
Disable HID drivers in kernel.
Disable TTY support on kernel
Disable getty on TTY.
Is it sufficiant to disable all TTYs?
Should be, yes.
Can I build a Linux without a login possibility?
For sure. Most embedded firmware are built with Yocto or Buildroot. Using these ...
Encrypt with WPA-2 with AES: Make sure the router you get has that capability. Most do, since WPA-2 has been around a while.
Hide your network name: A setting in the wireless router. Hide "SSID" or similar. Also, most wireless router will have this. Users will have to manually input the SSID however.
Turn off UPnP (is this easy to do?): Yes. Another setting ...
yes it is possible if only you could run the script on the same router page or with same url with some kind of local DNS rebinding to trick the browser that you are sending the request to the same site that the request is made from and both are the router page(address-ip) and redirecting only after you set the cookies manually ... or if some how you could ...
By default, XMLHttpRequest does not include cookies. Use withCredentials to send cookies along.