The three bars, and why they move separately
A flood is not one problem. It lands on three resources in sequence, and each defense only touches some of them.
Your uplink is the wire from your ISP. Once packets are on it, they already spent that bandwidth. Nothing you run at home can un-spend it, because the congestion is upstream of your front door.
Your host CPU pays to look at every packet, even the ones it drops. A kernel firewall rule that discards a flood still ran once per packet. At a few hundred thousand packets a second that is a real bill.
Your application is the game server or web app. This is the one an in-host allowlist or a WAF actually protects, by refusing the junk before your code sees it.
A network-namespace lab: one honest player, one UDP flood of spoofed sources, an nftables allowlist that only trusts sources with a sustained session. The sentinel flipped to allowlist-only within a fraction of a second.
The allowlist did its job at the app, yet the player still dropped out. The flood kept arriving at the host, and the CPU spent to inspect and drop it starved the game. In-host filtering protected the application, not the machine. That gap is the whole reason the upstream defenses exist.
Things you can build from this
The lab technique, productized: a small agent in front of Minecraft or Source servers that promotes real sessions and drops everyone else during a spike. Buys time and stops L7 and session floods. Pair it with an upstream front for volume.
Put customer game and web servers behind a filtered upstream (anycast scrubbing or a filtered VPS front with a tunnel home). The customer never exposes their origin, and volumetric floods die before the wire. This is a plan feature you can charge for.
Most servers that get hit never needed to be public. A tailnet (WireGuard) puts dev and staging on private addresses, so there is nothing on the public internet to flood. Free, and it closes the most common way small teams get knocked over.
The honest short version: an allowlist or a WAF is a real layer, and it is enough when the attack is not about raw volume. The moment it is about volume, the fight has to happen upstream of your pipe, because your pipe is the thing being filled.