I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by setting up a rule that will automatically block their IP by adding it to IPTables after a configured number of attempts in a configured amount of time. My question is, if all you are doing is rejecting their requests, then they still have access to try to send information on that port. Can they not still overload your server with requests?

I've done some research on this, and the only potential reason I could find is that with a DOS attack, they are restricted by their upload bandwidth which is almost guaranteed to be smaller than your download bandwidth, so even if they are trying to hit you as hard as they can with requests, if you block their IP and aren't doing any processing on the information then they are really throwing pebbles at a brick wall there. Is this correct? What other reasons would this you be protected from DOS with this method?