Clients cannot get out until I restart the firewall

After power-cycling (usually courtesy of the power company) my WRT3200ACM running 18.06.4, I can get out from the ssh shell on the router, e.g. "ping" works, but none of the inside clients can get out, my inside nameserver resolves no names outside my domain, etc. A traceroute from an inside host to an outside host stops at, the router.

After I choose "restart firewall" on the Luci Network -> Firewall -> Custom Rules page, everything works. Am I overlooking something, or is there a race condition, perhaps to be worked around with a sleep(1) in the custom rules script?

Note that I don't change the custom rules, which were scp'ed to the router long ago. I just choose "restart firewall". and all is well. It's a puzzle.

No idea, as we have no idea about your custom config. Possibly some nonstandard rules or routing causes something, but without any information or any logs it is a puzzle.