I just read that to protecting a server against a DDoS attack involves blacklisting IP addresses.
Please keep in mind that I limited experience in firewall configuration.
It's possible for blacklisting an IP to protect a server from a DDoS attack. A lot would depend on the firewall, the network, the system and the type of attack.
Blacklisting means you tell your firewall to take a special action against traffic from that IP or network range. You could tell your firewall to ignore traffic from that IP or reject that traffic. If your network and firewall can handle large amounts of traffic but your server cannot, that may stop the attack assuming the attacker doesn't change source IPs. It might be a useful short-term mitigation but usually isn't a long-term fix.
To "drop a connection" probably means to ignore it. The remote server would send (assuming TCP) a syn packet and your firewall would accept the packet, examine it, find that it matches a rule and then execute that rule. If you are dropping packets from that source then your firewall would do nothing further. Keep in mind that in order to find the rule it had to accept the packet and examine it which consumed a small amount of resources. Multiply that tiny resource consumption against a million packets and it starts to add up...
How would this protect a server? If the firewall and server are separate devices then the firewall takes all of the traffic load and the server doesn't have to deal with junk traffic. If they're on the same system then hopefully the firewall layer handles the traffic and it doesn't have to be processed by the application layer.
Blacklisting IPs at the firewall is a case of "enumerating badness" and in many cases doesn't scale well. Do you want to spend the next week of your life pouring through logs and adding firewall rules each time an attacker gets a new IP? In the long term there are better approaches:
The term blacklisting means that you effectively deny any connections (e.g. packets) to a particular IP address. Therefore all network packets with the blacklisted IP as the source or destination will not pass through the firewall. This can be considered a "dropped connection." Keep in mind that in cases where security is the highest priority, whitelisting trusted IPs is a better practice, meaning that only connections that are on your white list will be allowed and all others will be dropped. Blacklisting IPs does not remedy a DDoS attack. A DDoS attack is distributed, meaning it originates from many IP addresses. Furthermore IPs can be spoofed to appear to originate from a trustworthy source.
Basic blacklisting consists on ignoring packets coming from blacklisted addresses. They simply "drop it on the ground" and ignore it, making no further action after that beyond waiting for the next packet to analyse.
