The path is part of the http protocol. Most firewalls only parse the first couple layers (ethernet->ip->tcp/udp), not http as well, unless they do deep package inspection. Idk if openwrt/banip has functionality like that.

It might be easier (and more performant if the firewall has weak hardware) to just allow tcp port 80 and let your reverse proxy do the filtering for that, since it (usually) needs to parse the http anyways.

The open source server allows unlimited connections I think. The point of the paid server is user & device management, shared address book and some other enterprise features

A DDoS that brings down the biggest(?) DDoS protection provider?