a firewall isn't going to help against a DDOS. if packets are getting through to your pipe, even if you are denying them, you're pipe is going to be getting filled with data and become useless. Further, your firewall hardware may become overburdened by the size, number of packets coming on over the network can kill it. With a DOS attack, yo ucan generally call the ISP of the source and get them cut off. This becomes infinitely more difficult in the distributed scenario