Try closing unused ports on hardware firewall first. If that doesn’t help then we require a traffic capture in order to fix the bypass. To do so, execute tcpdump -w capture -c 100000 WHILE the attack is going on, so please use the console if you can’t SSH your server. That’ll generate a file. Upload that file here: https://plik.fulltimehosting.net and open a ticket with the link to the file along with a list of the ports and protocol you use in order to identify the attack properly.