Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, however is there a way using iptables I can detect IPs who're making excessive requests, and drop their connections to avoid overloading my web server ? Or is there a better solution to filter these packets all the same while not negatively affecting legitimate clients.
I'm using apache, on ubuntu 12.04.