It looks like it's impossible to specify (in a cross-distro fashion) that a service should start up before any network interface configuration *begins*. (Before=network.target is too late.)
But such an ordering is essential for firewall services that need to avoid leaks. I propose the following:
1. Ship an empty network-pre.target.
2. Add to systemd-networkd.service and network.target:
3. Document #2 as a convention for other network interface configuration services to follow.
With this in place, a firewall service can finally do:
Implemented in the last release.