How to defend tcp syn attack when using snat

[Zheng konia <konianet@xxxxxxxxx>]

HI,

    We are using nftable as a NAT role, like

    client <====> Nftables (dnat+snat) <====> server

   When attacker creating thousands of  tcp syn to Nftables, snat will
use up all the sport, since nftable never do the real tcp connection
with client before forward to server.

    How can I avoid this attack? Any way to check the reality of tcp
syn requests?

    Thanks.