None of these answers above will help.
If your site is under a DDoS attack, the only real, usable source of help is in the form of the technical contact at your upstream provider.
Yes, you can deny and drop packets at the edge of your network, but it won't make a wit of difference if your connection has already been saturated by the traffic coming in from the outside.
You need to work with your provider to drop the traffic when it reaches the outside of their network, which has lots of spare redundant capacity, and is a lot easier to apply whole null route blocks to.
Changing iptables, or rewrites on your webserver, might give you the impression of stopping an attack, but it's like trying to put a bandaid over a gashed artery.
The sheer volume of attack traffic can even overwhelm your kernel, if it's doing iptables stuff, dropping traffic takes up CPU time too. Get your ISP/Transit provider to do it.
It's easier from their point of view, too.