A gateway (router/firewall) on your own connection cannot protect you against a DDoS. Really nothing at your connection can prevent you from getting DDoSed. The

A gateway (router/firewall) on your own connection cannot protect you against a DDoS. Really nothing at your connection can prevent you from getting DDoSed. The attacker can cause you to go offline/degraded even if you are 100% successful at dropping his packets. They still fill up your inbound pipe and prevent (or majorly hinder) legitimate traffic from fitting in. The filtering/dropping of packets has to be upstream of your connection to be able to protect your connection - additionally somewhere where the available bandwidth is greater than the attacker's bandwidth.