[Freeswitch-users] Avoiding DDoS with verto?

After reading about recent DDoS attacks on VOIP providers in https://www.rtcsec.com/post/2021/09/massive-ddos-attacks-on-voip-providers-a... in which Freeswitch is mentioned, I wondered what current practices are for services that must serve the public Internet. For example, a service that is purely verto-based seems like it could protect itself in this way: 1) Block requests on all ports (except the verto WSS login) unless the request is from an address that's already part of signaling. 2) To protect signaling, put it behind AWS API Gateway, which provides rate-limiting, and add an authorization check. Does this seem like it would defend against DDoS? Can FS be configured to do #1?