DOS Attack from local network to wan, identification and Prevention

Question

Past few days, we have been facing a possible syn flooding DOS attack. This attack happens twice a day (afternoon and at night), one random IP in our network gets active (ev