After you add a ip (subnet) to the DDoS filter, your auto null settings does nto work anymore. Reason for this is that when you add a ip to the DDoS filter, the real maximum of protection is felxible, depending of the type of your attack. Sometimes it is 50Gbps, somtimes 100Gbps. Therefore, during a DDoS, the DDoS filter will see what is possible overrule your manual settings.