diff --git a/modules/programs/virtualbox.nix b/modules/programs/virtualbox.nix
index 0fb4a95d30bf..7bce11ab8553 100644
--- a/modules/programs/virtualbox.nix
+++ b/modules/programs/virtualbox.nix
@@ -23,7 +23,6 @@ let virtualbox = config.boot.kernelPackages.virtualbox; in
     { description = "VirtualBox vboxnet0 Interface";
       requires = [ "dev-vboxnetctl.device" ];
       after = [ "dev-vboxnetctl.device" ];
-      before = [ "network-interfaces.service" ];
       wantedBy = [ "network.target" "sys-subsystem-net-devices-vboxnet0.device" ];
       path = [ virtualbox ];
       preStart =
diff --git a/modules/services/networking/dhcpcd.nix b/modules/services/networking/dhcpcd.nix
index cfbc7ba3679c..4f89f77b12b9 100644
--- a/modules/services/networking/dhcpcd.nix
+++ b/modules/services/networking/dhcpcd.nix
@@ -95,7 +95,7 @@ in
       { description = "DHCP Client";
 
         wantedBy = [ "multi-user.target" ];
-        after = [ "network-interfaces.service" ];
+        after = [ "network-interfaces.target" ];
 
         path = [ dhcpcd pkgs.nettools pkgs.openresolv ];
 
diff --git a/modules/system/upstart/upstart.nix b/modules/system/upstart/upstart.nix
index d6362a0e4ca0..9d17b352dc88 100644
--- a/modules/system/upstart/upstart.nix
+++ b/modules/system/upstart/upstart.nix
@@ -59,7 +59,7 @@ let
       after =
         (if job.startOn == "stopped udevtrigger" then [ "systemd-udev-settle.service" ] else
          if job.startOn == "started udev" then [ "systemd-udev.service" ] else
-         if job.startOn == "started network-interfaces" then [ "network-interfaces.service" ] else
+         if job.startOn == "started network-interfaces" then [ "network-interfaces.target" ] else
          if job.startOn == "started networking" then [ "network.target" ] else
          if job.startOn == "ip-up" then [] else
          if job.startOn == "" || job.startOn == "startup" then [] else
diff --git a/modules/tasks/network-interfaces.nix b/modules/tasks/network-interfaces.nix
index 20e1a0066750..8c2a3215f2a2 100644
--- a/modules/tasks/network-interfaces.nix
+++ b/modules/tasks/network-interfaces.nix
@@ -246,47 +246,54 @@ in
 
     security.setuidPrograms = [ "ping" "ping6" ];
 
-    jobs."network-interfaces" =
-      { description = "Static Network Interfaces";
-
-        after = [ "systemd-udev-settle.service" ];
-        before = [ "network.target" ];
+    boot.systemd.targets."network-interfaces" =
+      { description = "All Network Interfaces";
         wantedBy = [ "network.target" ];
-
-        path = [ pkgs.iproute ];
-
-        preStart =
-          ''
-            set +e # continue in case of errors
-
-            # Set the static DNS configuration, if given.
-            cat | ${pkgs.openresolv}/sbin/resolvconf -a static <<EOF
-            ${optionalString (cfg.nameservers != [] && cfg.domain != "") ''
-              domain ${cfg.domain}
-            ''}
-            ${flip concatMapStrings cfg.nameservers (ns: ''
-              nameserver ${ns}
-            '')}
-            EOF
-
-            # Set the default gateway.
-            ${optionalString (cfg.defaultGateway != "") ''
-              ip route add default via "${cfg.defaultGateway}"
-            ''}
-
-            # Turn on forwarding if any interface has enabled proxy_arp.
-            ${optionalString (any (i: i.proxyARP) cfg.interfaces) ''
-              echo 1 > /proc/sys/net/ipv4/ip_forward
-            ''}
-
-            # Run any user-specified commands.
-            ${pkgs.stdenv.shell} ${pkgs.writeText "local-net-cmds" cfg.localCommands}
-          '';
       };
 
     boot.systemd.services =
       let
 
+        networkSetup =
+          { description = "Networking Setup";
+
+            after = [ "network-interfaces.target" ];
+            before = [ "network.target" ];
+            wantedBy = [ "network.target" ];
+
+            path = [ pkgs.iproute ];
+
+            serviceConfig.Type = "oneshot";
+            serviceConfig.RemainAfterExit = true;
+
+            script =
+              ''
+                # Set the static DNS configuration, if given.
+                cat | ${pkgs.openresolv}/sbin/resolvconf -a static <<EOF
+                ${optionalString (cfg.nameservers != [] && cfg.domain != "") ''
+                  domain ${cfg.domain}
+                ''}
+                ${flip concatMapStrings cfg.nameservers (ns: ''
+                  nameserver ${ns}
+                '')}
+                EOF
+
+                # Set the default gateway.
+                ${optionalString (cfg.defaultGateway != "") ''
+                  # FIXME: get rid of "|| true" (necessary to make it idempotent).
+                  ip route add default via "${cfg.defaultGateway}" || true
+                ''}
+
+                # Turn on forwarding if any interface has enabled proxy_arp.
+                ${optionalString (any (i: i.proxyARP) cfg.interfaces) ''
+                  echo 1 > /proc/sys/net/ipv4/ip_forward
+                ''}
+
+                # Run any user-specified commands.
+                ${cfg.localCommands}
+              '';
+          };
+
         # For each interface <foo>, create a job ‘<foo>-cfg.service"
         # that performs static configuration.  It has a "wants"
         # dependency on ‘<foo>.service’, which is supposed to create
@@ -301,7 +308,7 @@ in
                 if i.subnetMask != "" then i.subnetMask else "32";
           in
           { description = "Configuration of ${i.name}";
-            wantedBy = [ "network.target" ];
+            wantedBy = [ "network-interfaces.target" ];
             bindsTo = [ "sys-subsystem-net-devices-${i.name}.device" ];
             after = [ "sys-subsystem-net-devices-${i.name}.device" ];
             serviceConfig.Type = "oneshot";
@@ -389,7 +396,8 @@ in
       in listToAttrs (
            map configureInterface cfg.interfaces ++
            map createTunDevice (filter (i: i.virtual) cfg.interfaces))
-         // mapAttrs createBridgeDevice cfg.bridges;
+         // mapAttrs createBridgeDevice cfg.bridges
+         // { "network-setup" = networkSetup; };
 
     # Set the host name in the activation script.  Don't clear it if
     # it's not configured in the NixOS configuration, since it may