Make each "hit" cost as little to you in bandwidth/resources, and as much as possible to the attacker.

National solution is to stop known bad nodes at the ISP level.

For the basic attack,

1) Webserver - Set threshold and block offending IP [1]

2) TCP/DNS/SYNC/SSL/HTTP - Get DDoS-filtered IP and create GRE tunnel back to your server. You can get one for less than $10 from OVH, BuyVM or Ramnode.

[1] http://deflate.medialayer.com

Egress filtering in ISPs and backbone providers. People should not be able to syn flood in 2015.

In brief, you have more bandwidth than your attacker.