If you're under attack now, you should get a new public IP first. Then you can hide behind Cloudflare and drop all unproxied connections. Unless and until you get a new IP, no amount of Cloudflare wizardry can stop all the direct traffic that you're already getting.
If your host's bandwidth is so completely saturated by the attack that no amount of IP switching will help, well, you should find a new host.
