Thanks for the reply.
I see that in allowed IP (whitelist) it's set as ALL - which I think is the default?
If you have allowed set to 'ALL' - would the anti-DDoS still work?
Or does this mean the problem is elsewhere?
The 300 second 'outage' does seem to fit though..