jow-:

If at all, then this is likely an upstream bug. I don't think this will ever be fixed though, the times are basically translated once and then set forever.

There is no infrastructure at all in the kernel that follows all the DST nuisances as that would require having something equivalent to the tzdata database in kernelspace.

Can't really think of a good solution to this at all. Maybe setup cron jobs that restart the firewall shortly after the DST transition dates (which might be dynamic for your particular location) - that should force deleting and re-adding rules with a new local time.

mactenchi:

Might I suggest disallowing time-based rules that use local time and always use UTC time? That would at least behave predictably.