The global limit (1 SYN/s, burst 3, no per-source tracking) dropped legitimate TCP connections to the gateway itself (up to ~45% on busy gateways: DNS zone transfers, SSH, monitoring), and a few SYNs per second were enough to lock out all TCP access. Kernel SYN cookies (tcp_syncookies) already provide proper SYN flood protection.