I put a crowd-sourced firewall in front of my exposed homelab, and it started blocking attacks on day one

The firewall wasn't wrong, just incomplete.