IPS not blocking

Question

Hi Guys, 
 We are having an issue with one our websites. 
 Last time we see that this website is getting slow and slower, I did check the UTM logs and I can see that from certain country and different IP address they try to download the pictures of this website. Until now I just block each IP manually but now this getting out of the hand and I cannot keep blocking them. 
 Downloading picture from the website is allowed but 70 get request in one second from single IP is not right. 
 Is there a setting in IPS that we can use to put a limit on how many get request an IP can send to an webserver? 
 Thanks

Jaydeep · Accepted Answer

This should definitely help. But I can not comment on what values you should keep. PLEASE BE AWARE that if you put a lower value, you might block/drop legitimate connections. 
 TCP SYN Flood Protection 
 To employ TCP SYN flood protection, enable "Use TCP SYN Flood Protection" 
 Mode: The following modes are available: 
 
 Both source and destination addresses: Select this option if you want to drop SYN packets that match both source and destination IP address. First, SYN packets are filtered that match the source IP address. Second, if there are still too many requests they will additionally be filtered according to the destination IP address. This mode is set as default. 
 Destination address only: Select this option if you want to drop SYN packets according to the destination IP address only. 
 Source address only: Select this option if you want to drop SYN packets according to the source IP address only. 
 
 Logging: This option lets you select the log level. The following levels are available: 
 
 Off: Select this log level if you want to turn logging completely off. 
 Limited: Selecting this log level will limit logging to five packets per second. This level is set as default. 
 Everything: Select this log level if you want verbose logging for all SYN (TCP) connection attempts. Note that SYN (TCP) flood attacks may lead to extensive logging. 
 Source Packet Rate: Here you can specify the rate of packets per second that is allowed for source IP addresses. 
 Destination Packet Rate: Here you can specify the rate of packets per second that is allowed for destination IP addresses. 
 
 Note: It is important to enter reasonable values here, for if you set the rate too high, your web server, for instance, might fail because it cannot deal with such an amount of SYN (TCP) packets. On the other hand, if you set the rate too low, your firewall might show some unpredictable behavior by blocking regular SYN (TCP) requests. Reasonable settings for every system heavily depend on your hardware. Therefore, replace the default values by numbers that are appropriate for your system. Click Apply and your settings will be saved.