Effectively protecting against a DDoS at the endpoint is impossible since your bandwidth would already be overwhelmed at that time. To protect against a DDoS you'll need the ISP's assistance (so they can re-route & scrub the attack before it floods your ingress point(s)).
Plug: I work for AT&T and we provide a DDoS mitigation service. Traffic inbound for your ingress point(s) are re-routed on the AT&T backbone to a scrubbing facility. After the 'bad' traffic is scrubbed, the 'good' traffic is routed back to you. I'm vastly oversimplifying but the point is your ingress point(s) are not overwhelmed even in the face of an attack which ordinarily would take you down.
