Software firewalls are good as the uplink the server has, they can also overload the system by trying to block a lot of IPs in short intervals. So a real DDoS mitigation is really the best solution, unfortunately that doesn't come cheap.