There's a lot that can be said about lightning protection, but it usually boils down to doing all of these things:
- make good, low impedance connections to Earth
- bond all Earth connections together with a low impedance path
- have only a single point of entry to protected equipment
A real problem when discussing lightning protection is that people will consider only some of these things, and the result is sometimes worse than doing nothing.
make good, low impedance connections to Earth
Just about everyone understands this one. You want long rods in the ground, at least 8 feet. Multiple rods, if you can, about as far apart as they are deep. Lightning currents from a big direct strike can be in excess of 100,000 amperes, so you need fat conductors so they aren't vaporized by the current. Lighting is also an extremely fast pulse, which means it contains a lot of high-frequency energy, and you should think about it like RF current. Wide strapping is better than round conductors (skin effect) and you should make the path of your conductor as straight and short as possible to minimize resistance and inductance.
bond all Earth connections together with a low impedance path
This one is frequently neglected. The current from a strike is so huge that it won't simply all go into the closest grounding rod can find. The Earth itself isn't a low impedance conductor, so even when lightning strikes a point in an empty field, significant voltage gradients can be observed significant distances away from the strike point.
W8JI has a great example of this, where a tree was struck, and some 20 feet away, arced back out of the ground to travel through a Beverage antenna.
Consequently, if you have multiple connections to Earth, or even things close to Earth, lightning currents will find a way to those points, even if that means flowing through your station equipment, arcing across water pipes, HVAC ducting, or even through wood or concrete in your home, which aren't great insulators. Bonding all the grounds together with heavy wire gives the current an intentional place to go.
Most building and fire codes require that all grounds are bonded with very heavy wire or strap, for this reason.
have only a single point of entry to protected equipment
Perhaps the most neglected point of all. If there are multiple points of entry, that means lightning current can enter at one point, and exit at another. As discussed in the previous point, lightning currents are so huge that they make significant voltage gradients almost everywhere, including between the two points of entry to your station. Where there are voltage gradients, there are currents, and where there are currents, things break.
A very common situation in amateur stations is to have a grounding rod at the mast or tower, where the feedline enters the shack, or both. W8JI provides a great diagram of a poor grounding system:
(I highly recommend reading through the rest of W8JI's lightning and grounding information. Lots of diagrams, pictures, and good advice. On this topic: Ground systems, House ground layouts, and Second floor grounding.)
When lightning strikes the power lines, some of this current will go to ground through the additional ground(s) at the tower or shack entrance. After passing through your equipment and frying it, of course. Strikes on the tower cause the same problem, in the other direction. This is a situation where a naïve attempt at protection has made things worse, virtually guaranteeing equipment damage when a strike occurs. Even a nearby strike might introduce enough of a voltage between the grounds to cook your equipment.
Worse, in some setups, disconnecting the feedline leaves this extra ground (B) still connected, violating the popular "wisdom" that disconnecting the feedline in a storm protects your equipment!
So what can you do?
the ideal approach
Ground the base of your tower or mast with a large field of radials and a lot of ground rods, spaced over a wide area, bonded together with wide copper strap. Bond the shields of all coax feedlines to this.
Surround your entire house in wide copper strap, with a hefty ground rod every eight feet or so.
Bond these two ground systems together with wide copper strap, so that any current caused by a voltage between them favors that strap over your feedlines. Make sure any utility grounds (electric, telco, etc) are also part of this system of grounds.
Every cable that enters your shack, including the mains wiring, any control lines up the tower for rotators and such, ethernet cables for a home network, everything, enters the shack through a big, fat copper plate that's connected with a wide, short, straight connection to the ground running around the house. Each of these cables go through protection devices such as gas discharge tubes or MOVs. Conductors that should be grounded (feedline shields, AC safety ground, etc) are bolted directly to the grounding panel.
With a setup like this, you can confidently leave your feedlines connected in a storm, and survive direct strikes to the antennas. In fact, your house is probably less likely to be damaged by lighting than ordinary residential construction. A direct strike may cause some damage to exterior components, burning insulation or melting thin-gauge wires, but equipment inside is quite safe.
more modest approach
Most people will not want to invest the time or money to install a protection scheme that extensive. If you don't have a tall tower, or you live in an area where lightning is not frequent, it may be difficult to justify such expenditures.
In this case, it's better to think about what you shouldn't do. Don't create an extra ground. It's better to address common-mode currents with baluns and proper antenna design. If you must have a ground (such as a vertical installed at ground level), then consider the ground part of the antenna, not the station, and be sure to disconnect it in storm conditions.