What stand-alone hardware firewall is compatible upstream of my AT&T Pace 5268AC?

Repeated DDOS barrage attacks keep overwhelming and crashing my AT&T Pace 5268AC.

AT&T techs recommend putting a stand-alone hardware firewall between the internet and the AT&T Pace 5268AC (upstream of the 5268AC) to protect it.

1. I don’t want to disable or diminish the firewall/safety features in the 5268AC - I want to add to them, upstream.
2. The 5268AC Data Input socket is a RJ11 6-pin 4-connector (Cat 5e 2-pair). The AT&T Data Input line from the wall socket is Cat 5e  2-pair.  So the output from the hardware firewall may need an adapter: Ethernet plug to a 6-pin 4-connector plug. 

For security, all WiFi is disabled. Everything is Cat 5e/Cat 6 Ethernet connected.