# VPN & Client behaviour customization

{% hint style="warning" %}

#### Availability

This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details.
{% endhint %}

After purchasing the Enterprise License the *Enterprise features* **tab will be activated**, enabling the administrator to configure additional features:

<figure><img src="https://3466771104-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe86iamwJVSYnIRsyVEAV%2Fuploads%2F5tD8Si330DDsjP8OGcE5%2Fimage.png?alt=media&#x26;token=67703cce-1011-4142-bf32-85f3d8c31854" alt=""><figcaption></figcaption></figure>

### Disable for users to manage their devices

When this option is enabled, **only users in the Admin group can manage devices in user profile**, for any other users adding/editing/removing their VPN devices is disabled.

### Disable ability to configure other VPN clients then Defguard desktop client

If '*Disable users' ability to manually configure WireGuard client*' option is **enabled**, then any user **has only possibility to configure Defguard desktop client.**

This option will not be available for users:

<figure><img src="https://3466771104-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe86iamwJVSYnIRsyVEAV%2Fuploads%2Fgit-blob-435e72970de244b187ec52db3ce12e28277d6ca7%2FScreenshot%202024-10-14%20at%2012.44.15.png?alt=media" alt=""><figcaption></figcaption></figure>

### Client traffic policy selection

One of the unique features of Defguard desktop client is the ability for users to choose whether to route only **predefined network traffic** or **all traffic** from their device through a connected VPN location.

<figure><img src="https://3466771104-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe86iamwJVSYnIRsyVEAV%2Fuploads%2Fa4B14zPLRTEWAndbC6kc%2Fimage.png?alt=media&#x26;token=6b27135d-41c3-4268-9b1e-8780ca925620" alt=""><figcaption></figcaption></figure>

However, in some cases administrators may want to enforce a specific behavior - allowing access only to predefined traffic or requiring all traffic to pass through the VPN.

<p align="center"><img src="https://3466771104-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe86iamwJVSYnIRsyVEAV%2Fuploads%2FXZhOGTMv3GI4nkQoKPSE%2Fimage.png?alt=media&#x26;token=1da4f7c4-66b9-4352-a954-2596d241e3b0" alt=""></p>

\
The **Client Traffic Policy** setting enables administrators to control this behavior as needed. The available options are:

* **None** - Users can freely choose between routing predefined traffic or all traffic through the VPN.
* **Disable all traffic** - Only predefined traffic is allowed, the "All traffic" option is disabled for users.
* **Force all traffic** - All traffic is routed through the VPN, the "All traffic" option is enforced and cannot be changed by users.

{% hint style="warning" %}
Please note that this option is only client-side enforced, meaning the user may manually modify Wireguard interface to force all traffic to go through the VPN.
{% endhint %}