I think we can't PREVENT Denial of Service (DOS), however we can REDUCE unauthorized packages from attacker by packet filter mechanism, or IP restriction (for small attack)(http://www.iis.net/download/DynamicIPRestrictions). For large attack, You can use hardware firewall such as Juniper, Cisco, Astaro...those hardware firewall help you audit and analyze in terms of layers in the OSI model. (You can refer to this video: http://channel9.msdn.com/Blogs/matthijs/Using-the-OSI-Model-for-Securing-Your-SharePoint-2010)
If an attack aims to SQL Server through port 1433, you should consider changing default port by a specific port and then make sure your firewall allows that specfic port.
I don't kinda believe software firewall, but if because of limited budget, you can consider some software products like Astaro, Forefront....
One thing you can implement to reduce DOS package is to build failover clustering functionality for web application, or NLB with DFS/DFS-R as well.
In a nutshell, there are many ways to REDUCE Dos but you have to have basic understanding of system mechanism, as well as skills of hacking/security prior to making your SharePoint more safely.