How to protect yourself from Amplified Reflection?

Question

System administration

People! Lately I've been facing the fact that Google is ddosing me. But on reflection and impulse, the same Google came up with the idea that this attacker is replacing the TCP headers of packets (Amplified Reflection).
I understand that the cant is for providers who do not validate packets passing through their equipment.
Your thoughts are interesting, how to protect yourself from this shit?

Answer 1

External IP - yours? The provider did everything right!
You decide how and which packages you accept and which not.
1. Allow only expected packets through the firewall.
2. Close tcp/udp relays of various services from outside.
Read