Get a hardware router ($40) and just block them. I have one and glad I do. Its blocking a steady stream of TCP and UDP traffic and there is no overhead on the system handling/blocking the requests. They can't even detect your system at the IP address.
My system was out for a week this summer due to storms. When it came back up I had a different dynamic IP address, and a host of "Bots" hitting port 21232 with GET requests. About 5000 a day from about 600 different IP addresses, plus the normal scans. Now over six months later with the same "dynamic" IP address, I am still getting about 350 hit per day from some of the same 140 IP addresses.
You would think these people would check their systems and remove such infections.
Not much I could do but let the firewall router handle them (and log them to my server). Seems I picked up the IP address of some infected system being used to service "Bots" for someone.
In tracking down the problem, I found partial UDP packets getting through the firewall router. They appear to be coming from a collage not far away. Sent the information to several groups, including Cisco who now owns Linksys. They soon released an update for their firewall router that takes care of this leak.
Late at night, the cable modem Receive LED has an almost steady glow of inbound packets. Most are not TCP packets, but UDP or "other". All are blocked by the router, so that a system based software firewall does not have to spend processor overhead handling them.