https://tcpshield.com/ they have a very generous free tier. It required spigot/bukkit plugins or a velocity plugin (velocity is a Minecraft proxy, think of this as NGINX for minecraft).

I have my services proxied through nginx and behind cloudflares free tier. That way I don’t have to worry about my IP getting exposed and opening myself up to DDOS/DOS attacks, which is a genuine threat if you do things that piss people off (I’m an admin on a popular minecraft server).