per-port SYN cookies

[HLPPC]

Hello,
While playing some videogames and using traffic shapers I noticed some significant differences using syncookies only and no syncookies as system tunables, with and without SYNPROXY, with and without fq_codel.

This excerpt from Wikipedia makes me concerned with globally enabling SYNcookies in pfSense:

If SYN cookies are in operation, care should be taken to ensure an attacker is not able to bypass such a firewall by forging ACKs instead, trying random sequence numbers until one is accepted. SYN cookies should be switched on and off on a per-portbasis, so that SYN cookies being enabled on a public port does not cause them to be recognised on a non-public port. The original Linux kernel implementation misunderstood this part of Bernstein's description and used a single global variable to switch on SYN cookies for all ports;[4] this was pointed out by a research student[5] and subsequently fixed in CVE-2001-0851.

How would one go about doing this correctly in a pfSense, connected directly to the internet? What about NAT behind an ISP router? What about in bridged mode? Thanks!