When running 'netctl enable' on a tuntap interface, netctl assumes from BindsToInterfaces being unset that it should depend on the interface itself (an interface that is only created when the profile is started). This means that after running 'netctl enable' on a tuntap profile, it cannot be started anymore (in particular, it will not start on boot). The same problem exists if you want to create a bridge or bonding interface with no slaves (I often create empty dummy bridges that gain interfaces on the fly, but by default those bridges have no slaves). netctl's unit_enable needs to learn how to distinguish these cases from the ones where BindsToInterfaces is set to Interface. On a related note, if sd_escape (in netctl) is called with an empty argument list, which happens if you try to work around this issue, your whole environment is dumped into a systemd file. It needs a check for $# == 0.