Building a dynamic firewall to block DDOS tcp and udp in CenTos 7

We are running a video audio chat service based on sort of cloud technology. I don't want to reveal the name of the program here yet. We need a firewall that is capable to block DDOS attacks of all kinds. We running this application on servers with a lot of cpu power and sufficient memory. In here we have ESXii software running and these servers we run to make the rooms are actually vm. We have a vm that acts as a main firewall server that protects the rest of the servers. This firewall server has a NIC in pass-through mode so we should be able to block more then in normal ways . This audio video program is using ports over the whole TCP and UDP range. In the past we had someone who wrote us a great firewall but it does not apply to our current needs anymore. This firewall is based on the idea... white-list / blacklist. Best would be if this firewall could act like the windows firewall. Everything is blocked by default... but executable / programs that are added in the firewall program, are able to open ports to send and listen. This is because we can not predefine default ports that are being used. The application we use now, has been changing over the years .. so some rules need to be changed or deleted or even newer added. I am sure that when you read this, a lot of more questions are poppin up before you you can decide to take this project. We have no idea how much time this is going to take, so if its a small or big project... ? Or even what is going to cost us. I hope we can discuss about the price while the project is on going. We do need a solution that is working.. and easy to be adjusted, gives logs. So if any one thinks he or she can help us, we really would like to hear from you.