Protecting against DDOS can be difficult, because a high proportion of the time you ISP runs out of resources (stateful firewalls or bandwidth) and will sink hole your IP block.
If your expecting DDOS then choose an ISP that can offer DDOS prevention and knows how to deal with high traffic loads , ask them for examples and system them have in place that can help. Turning you off is not an answer.
Be prepared to block netblocks of aggressive ddos machine or infact ddos network blocks with iptables or your own upstream firewall.
if a only a few ip's a using over 90% of you resources, block them.
Develop methods of detecting abusive clients (access certain scripts or pages, strange requests, out of order page requests etc etc and block them).
consider using inbound/outbound qos to control outbound bandwidth fairly to clients.
consider splitting database, application logic and web serving on to different hardware.
consider a load balancer with some beef caching nodes to soak up small attackers. But beware entering a resource war with your attacker is not the best idea, they will win! :-(
consider add adding a caching layer between you application and the database, which should keep load off your database server for repeat requests
if the ddos is targeting static content , not web scripts that require database resources, consider something like a CDN (cloud flare) that hides your actual ip address from the rest of the internet, and helps distribute load geographically. you get faster content delivered by to your users, and as a side effect you a get some ddos protection.
if you don't need UDP get your ISP to block the traffic at their border. if you only need port 80 and 443 then get your ISP to block this at their network permitter. If your ISP doesn't know what UDP or ports are get a new one... :-).
host your dns on separate infrastructure, with some one large who can deal with ddos. If you must host dns yourself, place it on separate infrastructure and a different network.
if your using SSL, make sure you can handle the cpu hit of SSL handshakes. SSL accelerators are expensive. Perhaps develop a system where only paid up customers or registered authenticated customers can connect via SSL. Same goes for port 80 connects, make sure your users are registered before they have access to the application. Could stop deep ddos attacks into your application.
anyway, sounds fun. what are you up to?