To do CloudFlare the nostr way:

Services (behind a firewall) can pay public servers to give them a tunnel to a public ip address. They could do that to several servers at once, where the provider's sole business could be fending of spam. If one of em causes too much spam you could just cut it off.

An interesting thought i'm having now is you could selectively reveal some of your ip addresses to your WoT, so your service always stays up for them, even if you're under attack through the publicly known IP's.