If you define on-premise as being accessed over a private network (which seems to be the idea here), then it is not directly vulnerable to DDoS at all, because it isn't reachable from the public internet.