1. Cloudflare bought an IP space.
2. They rented 3875 (as of today) 40 Gigabit servers from data centers to get 155 Terabit DDOS network.
3. They anycast their IPs to multiple servers so your two IP assigned webpage resolves at many nodes (but they need to keep these servers secure).
This anycasting makes the network harder to shutdown because you could just use the next servers bandwidth.
4. They also use software (mostly open source with their own developments on top) to mitigate DDOS attacks. This software can block real users but gets better over time.
5. They cache websites to the server’s RAM/NVME/SSD storage, and have some “server less worker’s” that utilize the CPU of the server for cost efficiency.
(Meme): they use lava lamps for cryptographic key generation.
Take away: anyone can be the next cloudflare! Sign up to one of the IP registries. (I suggest ARIN because they have the most freedom of speech for being based in the US.)
Buy some IP addresses (if you don’t have much then there are mitigations by using ports as anycast). Then get some servers (A starting place is datapacket.com). Setup Linux servers or BSD (for speed users). Get NGINX or whatever reverse proxy you want. Setup some scripts and DNS and now you can compete as the most open and free DDOS protection on the web!
BONUS TIP: Being based in the US means you only are legally required to censor the least amount of things compared to all other countries. So, if someone ever used the service wrong, best practice is to block the illegal content on the URL cache level or page level, so the website is still accessible and you preserve maximum speech.
-JC