Is there a reason that there is not a FORWARD (from SRC * to DST *) -j syn_flood protection rule created with this check box?
(in luci)
Perhaps I've mistaken - that any client with an enabled TCP Port Forward doesn't have SYN Flood protection on that port? 
How to protect myself from AYN?