Powerful hardware is probably the only defense for full-scale DDoS attacks.
Blocking users IP can help, but can also backfire, since actual players might be used in DDoS against you without knowing it.
Keep server connection handling fast and lightweight, to avoid adding extra ways they can attack.
First of all, the server must not allow a connection to do anything until it has been authenticated and shown to be a valid user. There is no reason the server should do anything for non-valid connections. Your players must have accounts on your server, and they must login with a password. The server should not do anything with a connection until a they can login successfully. Any expensive handling should only happen after the login has been completed. You could take this one step further, and block the IP address of anybody that makes too many bad login attempts, but this probably wont help much for the reasons below...
Trying to block connections in software will not stop a true DDoS attack. At best it would work in a specific scenario where you have angered a forum of thousands of members, who decided retaliate by spending all day trying to log in to your sever. Plausible, but not an efficient way to attack. Blocking them would reduce the load on your game server if you have a somewhat expensive authentication scheme.
A true DDoS, however, ignores your login protocol. It operates at the lower network layers; before your application ever knows a packet has been received. These types of attacks cannot be mitigated other than by hardware that is powerful enough to withstand more abuse than your attackers can deal out. Special hardware firewalls might help here. The firewall itself can block connections based on it's own logic, but it still has limits. A more expensive firewall might have higher limits, but still probably can't withstand 10 million attackers. Now if your game server is a server cluster in dozens of locations each with it's own expensive router and firewall... it stands a much better chance overall. That might be more cost than any game server is worth, but even modestly priced routers have some traffic filtering.
Blocking connections in your code when your firewall can't might prevent your code from suffering a secondary hit on the processor and memory, and neither can help with network saturation. (You can close your front door to stop people from trampling all over your house, but that does not stop them from crowding your driveway. You could add a gate, but they can swarm the gate. You could build a bigger gate, but enough of them can swarm that too.)
Weather in software or through a firewall, blocking users by IP does have a downside. Imagine if a troll who hates your game decided to create a webpage with a script that makes login attempts to your game. If they upload this page to one of your games forums, any legitimate players who pass by that page will unknowingly be making login attempts. Not only does this cause problems for your server handling these requests... but if your sever blocks them, then you are potentially blocking legitimate players!
So, in closing, make sure you have a proper and efficient login protocol, as good of a router/firewall as you can afford, and that you are very careful about how you block IP addresses, if at all.