CSF Firewall is blocking these attacks in /var/log/messages
Feb 25 02:13:33 servidor kernel: Firewall: *SYNFLOOD Blocked* IN=eth1 OUT= MAC=00:25:90:de:d3:d5:00:19:e8:f4:7a:3f:08:00 SRC=120.43.114.117 DST=64.150.187.59 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=21531 DF PROTO=TCP SPT=4760 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Check with
# netstat -alntp | grep SYN | wc -l
You have set the following in your csf configuration but having such a setting, we definitely block SYN connections but legit connections as well.
SYNFLOOD = "1" SYNFLOOD_RATE = "1/s" SYNFLOOD_BURST = "3"
With the above settings, you will see a drop down in SYN connections but you won’t be able to browse your websites as well since it blocks legit clients as well.
The proper solution for the heavy attacks is a Hardware Firewall OR CloudFlare.
So if the attack is too heavy, go for any of the above 2 options since re-installation and blocking ports won’t solve the problem.