only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth

only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth or your stack's filtering capabilities. it's easy to rent GBits of distributed attack bandwidth.