How to improve performance of iptable anti-synflood ?

I have script iptable, it can anti-syn_flood on port 80-http
But when run this script, access to my webserver become slow (delay in some second, and some element can not show), while CPU and RAM used only 30%.

If Anti-syn_flood of iptable make my web server become slow, (because it must Count SYN packet before allow or deny), this is normall? or have any TIP to improve this?

My iptable script:

iptables -N syn_flood
iptables -A INPUT -p tcp --dport 80 --syn -j syn_flood
iptables -A syn_flood -m limit --limit 10/s --limit-burst 10 -j RETURN
iptables -A syn_flood -j DROP
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

Select all Open in new window