In this article

SecureTransit adds an encrypted tunnel to the Windows Roaming Client using WireGuard (default) or IKEv2, protecting device traffic on untrusted networks such as public Wi-Fi and hotel connections. It runs alongside DNS filtering without affecting filtering policies or reporting.

SecureTransit is not a full VPN product and does not include features such as secure file access or compliance-level connection logging.

Applies to Sales-managed accounts only. SecureTransit is not available for macOS, iOS, or Android agents, self-service accounts, or distributor accounts.

Network admins enable and configure SecureTransit for Windows Roaming Clients.

Prerequisites

The following requirements must be met before enabling SecureTransit:

• Windows Roaming Client v3.7.1 or higher
• Plus plan with the SecureTransit add-on
• Sales-managed account with SecureTransit enabled

SecureTransit is compatible with both Classic DNS Filtering and DNS PreCheck filtering modes. No specific filtering mode is required.

Complete the following steps after SecureTransit is enabled for the account.

Enable SecureTransit for the Organization

SecureTransit is disabled by default and must be enabled at the Organization level before individual Roaming Clients can connect.

For MSP accounts:

1. From the MSP dashboard, navigate to MSP > Subscriptions.
2. Locate the Client Organization and select the Advanced Edit icon.

3. In the Features section, enable the SecureTransit toggle.

   Caution: After SecureTransit is enabled, the tray icon is visible on all affected Roaming Clients, including devices where it was previously hidden. End users should be informed to expect the tray icon to appear.

4. Select a Default State for all Roaming Clients in the Organization:
   • Always On: SecureTransit connects automatically on startup and reconnects if the connection drops
   • Manual: SecureTransit is available but the end user initiates and terminates the connection from the system tray
   • Disabled: SecureTransit is off at the device level
5. Select Save Organization.

Roaming Clients apply the configuration change within approximately 5 minutes. No restart or reinstall is required.

The SecureTransit connection does not display in the modern Windows Settings VPN screen. To verify the connection at the OS level, navigate to Control Panel > Network and Sharing Center.

To override SecureTransit settings for individual Roaming Clients, see the Override SecureTransit settings per Roaming Client section of the Manage SecureTransit article.

Monitor license usage

From the DNSFilter dashboard, navigate to Subscription Management. A SecureTransit License Usage card at the top of the page shows total licenses purchased and licenses currently in use. The card displays only when SecureTransit has been purchased.

SecureTransit licenses are purchased separately from plan licenses. Enabling SecureTransit on more devices than licenses purchased is permitted. The system records the overage but does not block or disconnect devices.

End-user experience

When SecureTransit is enabled and the agent's effective mode is Always On or Manual, the SecureTransit VPN section appears in the Windows system tray. The tray icon cannot be hidden or disabled by the end user.

Tray icon states:

• Green: Connected
• Black: Reconnecting
• Red: Failed or error
• Grey: Disabled or not connected

In Always On mode, the tunnel connects automatically with no user action required. In Manual mode, the user selects Connect from the tray to start the tunnel. When the Organization allows transport overrides, the user can also select the connection protocol — WireGuard or IKEv2 — from the Transport Protocol submenu in the tray. WireGuard is selected by default. All standard Roaming Client tray menu options remain accessible.

If a connection drops, the agent reconnects automatically. A connection established but dropped within 5 seconds is classified as a failure and triggers a retry with an increasing wait interval up to a maximum of 1 hour.

Known limitations

The following limitations apply:

• Public Wi-Fi port restrictions: Some public networks block the ports required for WireGuard or IKEv2. SecureTransit may be unable to connect on these networks. This is a network-level restriction.
• Third-party security tool compatibility: Some security tools may flag or block SecureTransit traffic based on IP address. To allowlist SecureTransit gateway IPs, see the full list of gateway IP addresses. This list may expand as new servers are added.

Related content

• Manage SecureTransit in the Roaming Client dashboard
• Manage Roaming Client settings
• Subscription management