Recently, someone asked my help regarding their offline server. I checked that the server was offline but OS was still ON from KVM console. When tried restarting, it stuck on Intel Boot agent DCHP client Check which was a sure sign of a DDOS attack but hetzner has a DDOS protection, then how did it happen!
It happened because an Internal Hetzner server from DC was sending packets on 5000+ UDP Ports. That simply means hetzner had a DDOS prevention from outside their network only and cannot defend servers against internal DDOS attacks. To even boot up the server, I had to apply robot firewall to drop all connections, then configured manual firewall CSF through KVM and fire up the OS again!
Just wanted to share this nightmare!
(No disrespect to Hetzner, I still love their services)(At least OVH knows about their customers and has an internal Mitigation as well, though their support S**K)