I'm assuming you also want a simple way to mitigate layer 7 attacks, which is the hard part. You can try something like gathering statistics of /24 IP subnets that make connections to your server and once you detect increase in unseen subnets that goes over some threshold you think your server can't handle - nullroute unseen subnets that go over that threshold for some short period of time. And on a web server side configure rate limiting for everything.