If they're truly getting DOSed (not necessarily DDOS) then a firewall is can't do all that much anyway. It needs to be handled by upstream devices.

Does their router have any ability to show current traffic in/out? Is it possible a device like the laptop is infected and creating large amounts of outgoing traffic (e.g. spam) which might present itself as the internet going down?