I have firewall rule with extra-> time/day.
problem is the clock isn't set until after bootup (ip -> cloud -> update time)

the firewall rule is not realising that the clock has changed.

shouldn't it check maybe every minute to see what the time really is?

I can disable and then enable the firewall rule and it works ok, until the next bootup.

seems like it might work if sntp client is used instead of cloud-time ? Sounds like a bug?

disable the rules with one schelurer run at startup,
and add one script that check every 1 min until ntp status is "syncronized" and then reactivate the rules