This question already has an answer here:
- I am under DDoS. What can I do? 4 answers
I asked somewhere else, and I got this response:
Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine tune your tcp timeout options some of the settings are hardcoded into the kernel. A REJECT is very quick and takes tiny bandwidth. For more information Google "drop vs reject".
I researched on what he said and he seems correct, but I just want to make sure.