As the negative rating probably hints, this approach is not popular. It's extreme - it may do more damage then you are already experiencing. On the other hand, if your server goes 100% down as a result of the DDOS then the following Lock-down approach will provide some relieve to your situation.
Try this only if nothing else helps.
The Lock-down approach
Set a temporary firewall rule that will drop new incoming connections by destination (your server's IP). Your server will drop new connections during the attack time period.
What would this achieve
It will keep the server load down. Let you manage the server during the attack. Keep the service available to a white-list of valid customers.
Resuming Service Periodically
You would want to remove the firewall rule periodically for a short period of time. This will provide a chance to detect when the attack is over or when it becomes reduced. Once the attack is over your script should remove the firewall rule permanently.
You can white-list your and you supervisor's workstations so that both of you can access the server during the attack.
Infer a list of IPs of real customers (a good thing to do in general) and white-list that set.
- Parse out the IPs of users prior the start of the DDOS from your access logs.
- Keep a list of those IP for which at any point of time there was a Captcha solution.
Some of the legitimate customers will have the server available to them. Go for more true positives - if you white-list some of the DDOSers then no big deal.
You can try adding large chunks of IP spaces to the white-list. See how many DDOSers you can handle before you server starts to slow down again.
Another white-listing idea
- White-list's a large chunk of IPs. Let's call it Region A.
- Figure out what are the most IPs
- Block Region A and wait for 20 minutes (most real users will give up trying by that time)
- White-list Region A again an get the list of active users again.
- Compare the 2 lists - the IP that are still pounding are most likely the DDOSers - block them and white-list everything else in the State A.
- Repeat steps 1 through 6 for the next large chunk of IPs (Region B).