How can a SYN flood affect a router in this scenario?

Question

I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet.

Going over the logs of this router, I was surprised to find what is logged as "SYN flood". I have several entries such as:

Nov 18 21:27:50 [ATTACK]: SYN Flood from 173.194.222.188
Nov 18 12:58:16 [ATTACK]: SYN Flood from 209.85.233.188

There are 3-4 such entries per day. I haven't noticed any disruption in use. The IPs are supposed to originate from companies such as Google or Microsoft, but something tells me they are spoofed.

Questions

• How can a router which is not accessible from the internet be a subject of such an attack? Note that I have full control of all devices connected to it, and they are all trustworthy/up-to-date.
• Does a SYN flood attack against a home router have a meaning anyway? I was under the impression SYN flood attacks are related to servers.

I also took a look at this question, and I should note I don't have any port forwarding active.

Answer 1

If you connect from a decive in the LAN of router B to an external service, router B and A each do network address translation (NAT) so your device can receive an answer.

So basically there is a temporary port open to receive the answers and send them back to your device. The impact should be very limited, since normally the router accept only incoming traffic, if a device started the communication from the inside and the packages belong to that communication.

But in RFC 5382 is a possibility for port reuse: https://www.rfc-editor.org/rfc/rfc5382#section-4.3 If such a feature is enabled, an outside service could try to establish a connection through SYN packages. Does your routers support that feature?