Only thing that will help is either get a ddos firewall which cost $$$ or get a 1-10gbps line.

Anything else i would just use csf, but that is only minor protection. If the ddos is strong enough it will overload the firewall and kill the server.

Also you can use a reverse proxy if they provide ddos protection. Use cloudflare to have a easier way to block ip's