It's possible for blacklisting an IP to protect a server from a DDoS attack. A lot would depend on the firewall, the network, the system and the type of attack.
Blacklisting means you tell your firewall to take a special action against traffic from that IP or network range. You could tell your firewall to ignore traffic from that IP or reject that traffic. If your network and firewall can handle large amounts of traffic but your server cannot, that may stop the attack assuming the attacker doesn't change source IPs. It might be a useful short-term mitigation but usually isn't a long-term fix.
To "drop a connection" probably means to ignore it. The remote server would send (assuming TCP) a syn packet and your firewall would accept the packet, examine it, find that it matches a rule and then execute that rule. If you are dropping packets from that source then your firewall would do nothing further. Keep in mind that in order to find the rule it had to accept the packet and examine it which consumed a small amount of resources. Multiply that tiny resource consumption against a million packets and it starts to add up...
How would this protect a server? If the firewall and server are separate devices then the firewall takes all of the traffic load and the server doesn't have to deal with junk traffic. If they're on the same system then hopefully the firewall layer handles the traffic and it doesn't have to be processed by the application layer.
Blacklisting IPs at the firewall is a case of "enumerating badness" and in many cases doesn't scale well. Do you want to spend the next week of your life pouring through logs and adding firewall rules each time an attacker gets a new IP? In the long term there are better approaches:
- Whitelist known-good IPs - if possible, only allow traffic from your
trusted partners and block everything else by default.
- Implement a system that can automatically review traffic and filter out the unwanted traffic
- Build a system that can scale to meet your expected traffic load as well as spikes of unwanted traffic. This would need to happen at all layers: network, firewall, application, etc.