Detecting TCP SYN Flood

ferm.conf output

/usr/sbin/ipset -exist create active_connections hash:ip timeout 30
/usr/sbin/ipset -exist create offenders hash:ip
# Generated by ferm 2.1 on Fri Feb 14 10:02:12 2014
*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
:active_connections - [0:0]
:prevent_tcp_syn_flood - [0:0]
-A FORWARD --protocol udp --jump DROP
-A FORWARD --protocol tcp --jump REJECT --reject-with tcp-reset
-A FORWARD --jump REJECT
-A INPUT --in-interface lo --jump ACCEPT
-A INPUT --match state --state ESTABLISHED,RELATED --jump active_connections
-A INPUT --match state --state INVALID --jump REJECT
-A INPUT --match set --match-set offenders src --jump DROP
-A INPUT --protocol tcp --syn --match set ! --match-set active_connections src --jump prevent_tcp_syn_flood
-A INPUT --protocol tcp --dport 443 --jump ACCEPT
-A INPUT --protocol tcp --dport 80 --jump ACCEPT
-A INPUT --protocol icmp --icmp-type echo-request --jump ACCEPT
-A INPUT --protocol udp --jump DROP
-A INPUT --protocol tcp --jump REJECT --reject-with tcp-reset
-A INPUT --jump REJECT
-A active_connections --protocol tcp --jump SET --add-set active_connections src
-A active_connections --jump ACCEPT
-A prevent_tcp_syn_flood --protocol tcp --match hashlimit --hashlimit 2/second --hashlimit-burst 20 --hashlimit-name tcp_syn_attack --hashlimit-mode srcip --jump RETURN
-A prevent_tcp_syn_flood --protocol tcp --jump LOG --log-prefix "Possible SYN Flood attack: "
COMMIT
/etc/init.d/fail2ban restart