In this article

Network admins use this article to enable and configure SecureTransit for Windows Roaming Clients.

SecureTransit adds an encrypted tunnel to the Windows Roaming Client using WireGuard (default) or IKEv2, protecting device traffic on untrusted networks such as public Wi-Fi and hotel connections. It runs alongside DNS filtering without affecting filtering policies or reporting.

✍️ SecureTransit provides encrypted tunneling for internet traffic. It is not a full VPN product and does not include features such as secure file access or compliance-level connection logging.

✍️ SecureTransit is currently in beta. At general availability, SecureTransit will require the Plus plan.

SecureTransit is available to Sales-Managed accounts. SecureTransit requires Windows Roaming Clients running v3.7.1 or higher, available on the Beta release channel. To switch a Roaming Client to the beta release channel, navigate to Roaming Clients, select Edit Roaming Client, select Agent Updates, and set Release Channel to Beta.

Complete the following steps after the add-on is purchased.

Enable SecureTransit for the Organization

SecureTransit is disabled by default and must be enabled at the Organization level before individual Roaming Clients can connect.

1. From the DNSFilter dashboard, navigate to Organization and select Settings
2. In the Features section, enable the SecureTransit toggle

3. Select a Default State for all Roaming Clients in the Organization:

   Default state	Behavior
   Always On	SecureTransit connects automatically on startup and reconnects if the connection drops
   Manual	SecureTransit is available but the end user initiates and terminates the connection from the system tray
   Disabled	SecureTransit is off at the device level

4. Select Save

Roaming Clients apply the configuration change within approximately 5 minutes. No restart or reinstall is required.

✍️ Enabling SecureTransit forces the tray icon to become visible on all affected Roaming Clients, including devices where it was previously hidden. End users should be informed to expect the tray icon to appear.

✍️ Disabling the org-level SecureTransit toggle hard-disables SecureTransit for all Roaming Clients at the Organization, including devices with individual overrides. Settings are preserved and restored automatically if the toggle is re-enabled.

For MSP accounts: SecureTransit is configured per Client Organization. From the MSP dashboard, navigate to Organizations, locate the Client Organization, and select Edit. In the Features section, enable the SecureTransit toggle and select a Default State.

Override SecureTransit mode per Roaming Client

Individual Roaming Clients can override the Organization default.

To override a single agent:

1. From the DNSFilter dashboard, navigate to Deployments and select Roaming Clients
2. Locate the agent and select Edit
3. Set the SecureTransit mode to Always On, Manual, Disabled, or Inherit from Organization
4. Select Save

Selecting Inherit from Organization causes the Roaming Client to follow the org default at all times. Any other explicit mode is independent of future org default changes.

To override multiple agents at once, select the checkboxes next to the agents in the grid and select Bulk Edit. Set the SecureTransit mode and select Save.

Changes take effect within approximately 5 minutes. When an override is active, the Roaming Client grid indicates the agent is overriding the Organization default

Monitor license usage

From the DNSFilter dashboard, navigate to Subscription Management. A SecureTransit License Usage card at the top of the page shows total licenses purchased and licenses currently in use. The card only appears when SecureTransit has been purchased.

SecureTransit licenses are purchased separately from plan licenses. Enabling SecureTransit on more devices than licenses purchased is permitted. The system records the overage but does not block or disconnect devices.

✍️ If an Organization's plan is downgraded to Core, SecureTransit entitlement is removed and all active SecureTransit connections on affected Roaming Clients are disconnected automatically.

End-user experience

When SecureTransit is enabled and the agent's effective mode is Always On or Manual, the SecureTransit VPN section appears in the Windows system tray. The tray icon cannot be hidden or disabled by the end user.

Tray icon states:

• Green: Connected
• Black: Reconnecting
• Red: Failed or error
• Grey: Disabled or not connected

In Always On mode, the tunnel connects automatically with no user action required. In Manual mode, the user selects Connect from the tray to start the tunnel. When the Organization allows transport overrides, the user can also select the connection protocol — WireGuard or IKEv2 — from the Transport Protocol submenu in the tray. WireGuard is selected by default. All standard Roaming Client tray menu options remain accessible.

If a connection drops, the agent reconnects automatically. A connection established but dropped within 5 seconds is classified as a failure and triggers a retry with an increasing wait interval up to a maximum of 1 hour.

✍️ The SecureTransit tray icon reflects tunnel connection status only — it does not indicate DNS filtering status. When the Windows Roaming Client is in DNS PreCheck mode, the Protection and Status fields in the dashboard may show Active and Online even when the SecureTransit icon shows red. These are independent systems.

Known limitations

The following limitations apply:

• Windows Roaming Client only: macOS, iOS, and Android agents are not supported 
• Self-serve accounts: SecureTransit is not available for self-service accounts at launch. Availability for self-service customers will be added in a future update 
• Distributor accounts: SecureTransit is not available for distributor accounts at launch
• Public Wi-Fi port restrictions: Some public networks block the ports required for WireGuard or IKEv2. SecureTransit may be unable to connect on these networks. This is a network-level restriction
• Windows VPN settings: The SecureTransit connection does not appear in the modern Windows Settings VPN screen. To verify the connection at the OS level, navigate to Control Panel and select Network and Sharing Center

Related content

• Manage Roaming Client settings
• Subscription management