It looks like it's impossible to specify (in a cross-distro fashion) that a service should start up before any network interface configuration *begins*. (Before=network.target is too late.)

But such an ordering is essential for firewall services that need to avoid leaks. I propose the following:

1. Ship an empty network-pre.target.

2. Add to systemd-networkd.service and network.target:

[Unit]
Requires=network-pre.target
After=network-pre.target

3. Document #2 as a convention for other network interface configuration services to follow.

With this in place, a firewall service can finally do:

[Unit]
Before=network-pre.target
[Install]
RequiredBy=network-pre.target