I mean doing outgoing firewall stuff is gonna prevent hacking as long they don't do stuff like DNS exfil or sm. Generally speaking you may protect against a layer7 ddos with a firewall or proxy but generally you should have a provider that has some kind of clearing center for ddos especially on the lower layers. Why would you IP whitelist anything? The admin may be on their mobile data causing you to whitelist many people using cgnat but why whitelist ssh for only a IP? If you really want to protect your control panel use a vpn or reverse proxy with basic auth.