Comment 22 for bug 336736

So is there a way how to start firewall before interface is up?

Why we have many packages which depend on this functionality?

See apt-file search etc/network/if-pre-up.d

bridge-utils: /etc/network/if-pre-up.d/bridge
ethtool: /etc/network/if-pre-up.d/ethtool
hostap-utils: /etc/network/if-pre-up.d/hostap-utils
hostapd: /etc/network/if-pre-up.d/hostapd
ifenslave-2.6: /etc/network/if-pre-up.d/ifenslave
ifupdown-extra: /etc/network/if-pre-up.d/00check-network-cable
ifupdown-scripts-zg2: /etc/network/if-pre-up.d/00README.linkdir
linux-wlan-ng: /etc/network/if-pre-up.d/linux-wlan-ng-pre-up
uml-utilities: /etc/network/if-pre-up.d/uml-utilities
vde2: /etc/network/if-pre-up.d/vde2
vlan: /etc/network/if-pre-up.d/vlan
whereami: /etc/network/if-pre-up.d/whereami
wireless-tools: /etc/network/if-pre-up.d/wireless-tools
wpasupplicant: /etc/network/if-pre-up.d/wpasupplicant