There is one problem though. If you restrict access for certain IPs, they still can make a call to your server, they try to access it and the server rejects it, but the problem is that they dont see the content, but your server might still be overloaded because it still has to deal with these IPs - in other words, it has to check the IP and then see if it is blocked, but that still means it loads the server, just does not allow access. This is a problem of DDoS in general and it is basically impossible to solve.