Answers to questions about the LVS cluster with Topology

If you have any questions about the LVS cluster, you can find the topology in the cluster. For more information, see Linux general technology-Linux technology and application. Customer problems:
CC attacks occur all the year round.
Occasionally large-volume DDOS attacks.
It also solves the problems of north-south interconnection.
Resource Information:
Five servers, one for the WEB source server, and four for the squid cluster mode (three for the sisters' relationship, one for the parent), one for China Netcom, three for China Telecom, however, the interconnection is very fast (the line has been optimized). When used, the DNSPOD round-robin resolution (the other party cannot determine whether there is a survival check, if not) is specific:


Problem:
Because the DNSPOD round robin service is used, the customer can open the website 100% if the Cache Server dies.
New Architecture ideas:
Use LVS + Keepalived to connect the server group in the put mode. The architecture is as follows:


Question:
1. When an attack occurs (CC or DDOS), does the LB server carry the load?
2. Which server does the customer PING? LB or RB server?
3. Can port 22 be attacked? If I use iptables + VPN for management, can the SQUID UDP port be attacked?
4. Can I attack the LVS or KLD detection port?
5. Does LVS use the LC or WLC scheduling mode to solve north-south interconnection problems? As long as the customer connects to the IP address of China Netcom, internal access is normal.