Firewalls can't protect against complex DDoS attacks; actually, they act as DDoS entry points. Attacks pass right through open firewall ports that are intended to allow access for legitimate users.