Routers don't do SYN proxying. SYNs are just regular packets and are passed along to a host.
FIREWALLs on the other hand, might use a SYN to make an entry in a table that's used to track connection state. That table might be overloaded by a SYN flood. Same thing applies to load balancers.
FIREWALLs on the other hand, might use a SYN to make an entry in a table that's used to track connection state. That table might be overloaded by a SYN flood. Same thing applies to load balancers.
SYN cookies work just fine at the ENDPOINTs.