diff --git a/src-tauri/.sqlx/query-0b161da55e36df9d0a10a52474a8cd49d4659d2d6faafdd2de0c985679d0703d.json b/src-tauri/.sqlx/query-0b161da55e36df9d0a10a52474a8cd49d4659d2d6faafdd2de0c985679d0703d.json
new file mode 100644
index 00000000..0f1dbfc0
--- /dev/null
+++ b/src-tauri/.sqlx/query-0b161da55e36df9d0a10a52474a8cd49d4659d2d6faafdd2de0c985679d0703d.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE instance SET name = $1, uuid = $2, url = $3, proxy_url = $4, username = $5, client_traffic_policy = $6, enterprise_enabled = $7, token = $8, openid_display_name = $9 WHERE id = $10;",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 10
+    },
+    "nullable": []
+  },
+  "hash": "0b161da55e36df9d0a10a52474a8cd49d4659d2d6faafdd2de0c985679d0703d"
+}
diff --git a/src-tauri/.sqlx/query-65b503d8af2eb227b555274ec98411966a0a410314d5c109df6477ce799b40d1.json b/src-tauri/.sqlx/query-2d9b3c0595f2d385336d0a86cfdae1a4c327622977707117bf88b6a43e9e8f96.json
similarity index 81%
rename from src-tauri/.sqlx/query-65b503d8af2eb227b555274ec98411966a0a410314d5c109df6477ce799b40d1.json
rename to src-tauri/.sqlx/query-2d9b3c0595f2d385336d0a86cfdae1a4c327622977707117bf88b6a43e9e8f96.json
index 57f2b8f7..13579fc7 100644
--- a/src-tauri/.sqlx/query-65b503d8af2eb227b555274ec98411966a0a410314d5c109df6477ce799b40d1.json
+++ b/src-tauri/.sqlx/query-2d9b3c0595f2d385336d0a86cfdae1a4c327622977707117bf88b6a43e9e8f96.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", disable_all_traffic, enterprise_enabled, openid_display_name FROM instance ORDER BY name ASC;",
+  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", client_traffic_policy, enterprise_enabled, openid_display_name FROM instance ORDER BY name ASC;",
   "describe": {
     "columns": [
       {
@@ -39,9 +39,9 @@
         "type_info": "Text"
       },
       {
-        "name": "disable_all_traffic",
+        "name": "client_traffic_policy",
         "ordinal": 7,
-        "type_info": "Bool"
+        "type_info": "Integer"
       },
       {
         "name": "enterprise_enabled",
@@ -70,5 +70,5 @@
       true
     ]
   },
-  "hash": "65b503d8af2eb227b555274ec98411966a0a410314d5c109df6477ce799b40d1"
+  "hash": "2d9b3c0595f2d385336d0a86cfdae1a4c327622977707117bf88b6a43e9e8f96"
 }
diff --git a/src-tauri/.sqlx/query-f4b187b6f90edb7fd65e82a60e786942680cd7c66c42a315de0e62e47c4f2df4.json b/src-tauri/.sqlx/query-3a157b6bcdba07c456e924798f797cdbdd6290ef6fa0420ddc0682ab10e14727.json
similarity index 80%
rename from src-tauri/.sqlx/query-f4b187b6f90edb7fd65e82a60e786942680cd7c66c42a315de0e62e47c4f2df4.json
rename to src-tauri/.sqlx/query-3a157b6bcdba07c456e924798f797cdbdd6290ef6fa0420ddc0682ab10e14727.json
index 881650b4..79b463d4 100644
--- a/src-tauri/.sqlx/query-f4b187b6f90edb7fd65e82a60e786942680cd7c66c42a315de0e62e47c4f2df4.json
+++ b/src-tauri/.sqlx/query-3a157b6bcdba07c456e924798f797cdbdd6290ef6fa0420ddc0682ab10e14727.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token, disable_all_traffic, enterprise_enabled, openid_display_name FROM instance\n            WHERE token IS NOT NULL ORDER BY name ASC;",
+  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token, client_traffic_policy, enterprise_enabled, openid_display_name FROM instance WHERE token IS NOT NULL ORDER BY name ASC;",
   "describe": {
     "columns": [
       {
@@ -39,9 +39,9 @@
         "type_info": "Text"
       },
       {
-        "name": "disable_all_traffic",
+        "name": "client_traffic_policy",
         "ordinal": 7,
-        "type_info": "Bool"
+        "type_info": "Integer"
       },
       {
         "name": "enterprise_enabled",
@@ -70,5 +70,5 @@
       true
     ]
   },
-  "hash": "f4b187b6f90edb7fd65e82a60e786942680cd7c66c42a315de0e62e47c4f2df4"
+  "hash": "3a157b6bcdba07c456e924798f797cdbdd6290ef6fa0420ddc0682ab10e14727"
 }
diff --git a/src-tauri/.sqlx/query-758d3c67336eecafab5fd20e4b03574995383092cdb4d7c3ebda6f933ea0f472.json b/src-tauri/.sqlx/query-758d3c67336eecafab5fd20e4b03574995383092cdb4d7c3ebda6f933ea0f472.json
deleted file mode 100644
index 40a4087a..00000000
--- a/src-tauri/.sqlx/query-758d3c67336eecafab5fd20e4b03574995383092cdb4d7c3ebda6f933ea0f472.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "UPDATE instance SET name = $1, uuid = $2, url = $3, proxy_url = $4, username = $5, disable_all_traffic = $6, enterprise_enabled = $7, token = $8, openid_display_name = $9 WHERE id = $10;",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 10
-    },
-    "nullable": []
-  },
-  "hash": "758d3c67336eecafab5fd20e4b03574995383092cdb4d7c3ebda6f933ea0f472"
-}
diff --git a/src-tauri/.sqlx/query-aa7d2c4c2100151b6f555ade668e72ceef8e7d1e39fcf0bcef0b7433457d3d2a.json b/src-tauri/.sqlx/query-7b9e30e8f67a024fb1ad94f76d16a22e221bdffc8ee37b777f26d02988f69bb1.json
similarity index 82%
rename from src-tauri/.sqlx/query-aa7d2c4c2100151b6f555ade668e72ceef8e7d1e39fcf0bcef0b7433457d3d2a.json
rename to src-tauri/.sqlx/query-7b9e30e8f67a024fb1ad94f76d16a22e221bdffc8ee37b777f26d02988f69bb1.json
index bfefdf36..3b65dac0 100644
--- a/src-tauri/.sqlx/query-aa7d2c4c2100151b6f555ade668e72ceef8e7d1e39fcf0bcef0b7433457d3d2a.json
+++ b/src-tauri/.sqlx/query-7b9e30e8f67a024fb1ad94f76d16a22e221bdffc8ee37b777f26d02988f69bb1.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", disable_all_traffic, enterprise_enabled, openid_display_name FROM instance WHERE id = $1;",
+  "query": "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", client_traffic_policy, enterprise_enabled, openid_display_name FROM instance WHERE id = $1;",
   "describe": {
     "columns": [
       {
@@ -39,9 +39,9 @@
         "type_info": "Text"
       },
       {
-        "name": "disable_all_traffic",
+        "name": "client_traffic_policy",
         "ordinal": 7,
-        "type_info": "Bool"
+        "type_info": "Integer"
       },
       {
         "name": "enterprise_enabled",
@@ -70,5 +70,5 @@
       true
     ]
   },
-  "hash": "aa7d2c4c2100151b6f555ade668e72ceef8e7d1e39fcf0bcef0b7433457d3d2a"
+  "hash": "7b9e30e8f67a024fb1ad94f76d16a22e221bdffc8ee37b777f26d02988f69bb1"
 }
diff --git a/src-tauri/.sqlx/query-95b89ca80a622d2c625c8d5523a8a59d947ae38b9ddf85a12e6c7bc9a6767f08.json b/src-tauri/.sqlx/query-c4a6b8e1c94eefc619c768ff4aac9aa248baf9553cea4f47ca9b1f6499bedaa3.json
similarity index 61%
rename from src-tauri/.sqlx/query-95b89ca80a622d2c625c8d5523a8a59d947ae38b9ddf85a12e6c7bc9a6767f08.json
rename to src-tauri/.sqlx/query-c4a6b8e1c94eefc619c768ff4aac9aa248baf9553cea4f47ca9b1f6499bedaa3.json
index 4b7ed9e3..ec67166e 100644
--- a/src-tauri/.sqlx/query-95b89ca80a622d2c625c8d5523a8a59d947ae38b9ddf85a12e6c7bc9a6767f08.json
+++ b/src-tauri/.sqlx/query-c4a6b8e1c94eefc619c768ff4aac9aa248baf9553cea4f47ca9b1f6499bedaa3.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "INSERT INTO instance (name, uuid, url, proxy_url, username, token, disable_all_traffic, enterprise_enabled) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id;",
+  "query": "INSERT INTO instance (name, uuid, url, proxy_url, username, token, client_traffic_policy , enterprise_enabled) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id;",
   "describe": {
     "columns": [
       {
@@ -16,5 +16,5 @@
       false
     ]
   },
-  "hash": "95b89ca80a622d2c625c8d5523a8a59d947ae38b9ddf85a12e6c7bc9a6767f08"
+  "hash": "c4a6b8e1c94eefc619c768ff4aac9aa248baf9553cea4f47ca9b1f6499bedaa3"
 }
diff --git a/src-tauri/.sqlx/query-d8d908979a8573ee2c32828fa562d1bf171b4a6e224cc238680e2e856811c62e.json b/src-tauri/.sqlx/query-d8d908979a8573ee2c32828fa562d1bf171b4a6e224cc238680e2e856811c62e.json
deleted file mode 100644
index e023a3a7..00000000
--- a/src-tauri/.sqlx/query-d8d908979a8573ee2c32828fa562d1bf171b4a6e224cc238680e2e856811c62e.json
+++ /dev/null
@@ -1,92 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT id, instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id,route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\" FROM location WHERE service_location_mode <= $1 ORDER BY name ASC;",
-  "describe": {
-    "columns": [
-      {
-        "name": "id",
-        "ordinal": 0,
-        "type_info": "Integer"
-      },
-      {
-        "name": "instance_id",
-        "ordinal": 1,
-        "type_info": "Integer"
-      },
-      {
-        "name": "name",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "address",
-        "ordinal": 3,
-        "type_info": "Text"
-      },
-      {
-        "name": "pubkey",
-        "ordinal": 4,
-        "type_info": "Text"
-      },
-      {
-        "name": "endpoint",
-        "ordinal": 5,
-        "type_info": "Text"
-      },
-      {
-        "name": "allowed_ips",
-        "ordinal": 6,
-        "type_info": "Text"
-      },
-      {
-        "name": "dns",
-        "ordinal": 7,
-        "type_info": "Text"
-      },
-      {
-        "name": "network_id",
-        "ordinal": 8,
-        "type_info": "Integer"
-      },
-      {
-        "name": "route_all_traffic",
-        "ordinal": 9,
-        "type_info": "Bool"
-      },
-      {
-        "name": "keepalive_interval",
-        "ordinal": 10,
-        "type_info": "Integer"
-      },
-      {
-        "name": "location_mfa_mode: LocationMfaMode",
-        "ordinal": 11,
-        "type_info": "Integer"
-      },
-      {
-        "name": "service_location_mode: ServiceLocationMode",
-        "ordinal": 12,
-        "type_info": "Integer"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      true,
-      false,
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "d8d908979a8573ee2c32828fa562d1bf171b4a6e224cc238680e2e856811c62e"
-}
diff --git a/src-tauri/migrations/20251117093105_force_all_traffic.sql b/src-tauri/migrations/20251117093105_force_all_traffic.sql
new file mode 100644
index 00000000..b6c2ca79
--- /dev/null
+++ b/src-tauri/migrations/20251117093105_force_all_traffic.sql
@@ -0,0 +1,16 @@
+-- add client_traffic_policy column to `instance` table
+-- since SQLite does not support native enums we'll store them as integers
+-- 0 - None
+-- 1 - Disable all traffic
+-- 2 - Force all traffic
+ALTER TABLE instance ADD COLUMN client_traffic_policy INTEGER NOT NULL DEFAULT 0;
+
+-- populate new column based on value in `disable_all_traffic` column
+UPDATE instance
+SET client_traffic_policy = CASE
+    WHEN disable_all_traffic = true THEN 1
+    ELSE 0
+END;
+
+-- drop the `disable_all_traffic` column since it's no longer needed
+ALTER TABLE instance DROP COLUMN disable_all_traffic;
diff --git a/src-tauri/proto b/src-tauri/proto
index db6741ae..74d60d91 160000
--- a/src-tauri/proto
+++ b/src-tauri/proto
@@ -1 +1 @@
-Subproject commit db6741ae29d030d0ffecd2ef52aebfb51e9c7f37
+Subproject commit 74d60d9171048ba0ccaf8a21b05950fb7a673f09
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 14e9f09c..be96139c 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -27,7 +27,7 @@ use crate::{
     database::{
         models::{
             connection::{ActiveConnection, Connection, ConnectionInfo},
-            instance::{Instance, InstanceInfo},
+            instance::{ClientTrafficPolicy, Instance, InstanceInfo},
             location::{Location, LocationMfaMode},
             location_stats::LocationStats,
             tunnel::{Tunnel, TunnelConnection, TunnelConnectionInfo, TunnelStats},
@@ -393,7 +393,7 @@ pub async fn all_instances() -> Result<Vec<InstanceInfo<Id>>, Error> {
             proxy_url: instance.proxy_url,
             active: connected,
             pubkey: keys.pubkey,
-            disable_all_traffic: instance.disable_all_traffic,
+            client_traffic_policy: instance.client_traffic_policy,
             enterprise_enabled: instance.enterprise_enabled,
             openid_display_name: instance.openid_display_name,
         });
@@ -576,15 +576,14 @@ pub(crate) async fn do_update_instance(
     instance.proxy_url = instance_info.proxy_url;
     instance.username = instance_info.username;
     // Make sure to update the locations too if we are disabling all traffic
-    if instance.disable_all_traffic != instance_info.disable_all_traffic
-        && instance_info.disable_all_traffic
+    let policy = instance_info.client_traffic_policy.into();
+    if instance.client_traffic_policy != policy && policy == ClientTrafficPolicy::DisableAllTraffic
     {
         debug!("Disabling all traffic for all locations of instance {instance}");
         Location::disable_all_traffic_for_all(transaction.as_mut(), instance.id).await?;
         debug!("Disabled all traffic for all locations of instance {instance}");
     }
-    instance.disable_all_traffic = instance_info.disable_all_traffic;
-    instance.enterprise_enabled = instance_info.enterprise_enabled;
+    instance.client_traffic_policy = instance_info.client_traffic_policy.into();
     instance.openid_display_name = instance_info.openid_display_name;
     instance.uuid = instance_info.id;
     // Token may be empty if it was not issued
@@ -923,11 +922,13 @@ pub async fn update_location_routing(
     match connection_type {
         ConnectionType::Location => {
             if let Some(mut location) = Location::find_by_id(&*DB_POOL, location_id).await? {
-                // Check if the instance has route_all_traffic disabled
                 let instance = Instance::find_by_id(&*DB_POOL, location.instance_id)
                     .await?
                     .ok_or(Error::NotFound)?;
-                if instance.disable_all_traffic && route_all_traffic {
+                // Check if the instance has route_all_traffic disabled
+                if (instance.client_traffic_policy == ClientTrafficPolicy::DisableAllTraffic)
+                    && route_all_traffic
+                {
                     error!(
                         "Couldn't update location routing: instance with id {} has \
                         route_all_traffic disabled.",
@@ -937,6 +938,19 @@ pub async fn update_location_routing(
                         "Instance has route_all_traffic disabled".into(),
                     ));
                 }
+                // Check if the instance has route_all_traffic enforced
+                if (instance.client_traffic_policy == ClientTrafficPolicy::ForceAllTraffic)
+                    && !route_all_traffic
+                {
+                    error!(
+                        "Couldn't update location routing: instance with id {} has \
+                        route_all_traffic enforced.",
+                        instance.id
+                    );
+                    return Err(Error::InternalError(
+                        "Instance has route_all_traffic enforced".into(),
+                    ));
+                }
 
                 location.route_all_traffic = route_all_traffic;
                 location.save(&*DB_POOL).await?;
diff --git a/src-tauri/src/database/models/instance.rs b/src-tauri/src/database/models/instance.rs
index 1a8339ba..0227afce 100644
--- a/src-tauri/src/database/models/instance.rs
+++ b/src-tauri/src/database/models/instance.rs
@@ -1,7 +1,7 @@
 use std::fmt;
 
 use serde::{Deserialize, Serialize};
-use sqlx::{query, query_as, SqliteExecutor};
+use sqlx::{prelude::Type, query, query_as, SqliteExecutor};
 
 use super::{Id, NoId};
 use crate::proto;
@@ -15,7 +15,7 @@ pub struct Instance<I = NoId> {
     pub proxy_url: String,
     pub username: String,
     pub token: Option<String>,
-    pub disable_all_traffic: bool,
+    pub client_traffic_policy: ClientTrafficPolicy,
     pub enterprise_enabled: bool,
     pub openid_display_name: Option<String>,
 }
@@ -28,6 +28,7 @@ impl fmt::Display for Instance<Id> {
 
 impl From<proto::InstanceInfo> for Instance<NoId> {
     fn from(instance_info: proto::InstanceInfo) -> Self {
+        let client_traffic_policy = ClientTrafficPolicy::from(&instance_info);
         Self {
             id: NoId,
             name: instance_info.name,
@@ -36,7 +37,7 @@ impl From<proto::InstanceInfo> for Instance<NoId> {
             proxy_url: instance_info.proxy_url,
             username: instance_info.username,
             token: None,
-            disable_all_traffic: instance_info.disable_all_traffic,
+            client_traffic_policy,
             enterprise_enabled: instance_info.enterprise_enabled,
             openid_display_name: instance_info.openid_display_name,
         }
@@ -50,13 +51,15 @@ impl Instance<Id> {
     {
         query!(
             "UPDATE instance SET name = $1, uuid = $2, url = $3, proxy_url = $4, username = $5, \
-            disable_all_traffic = $6, enterprise_enabled = $7, token = $8, openid_display_name = $9 WHERE id = $10;",
+            client_traffic_policy = $6, enterprise_enabled = $7, token = $8, \
+            openid_display_name = $9 \
+            WHERE id = $10;",
             self.name,
             self.uuid,
             self.url,
             self.proxy_url,
             self.username,
-            self.disable_all_traffic,
+            self.client_traffic_policy,
             self.enterprise_enabled,
             self.token,
             self.openid_display_name,
@@ -74,7 +77,8 @@ impl Instance<Id> {
         let instances = query_as!(
             Self,
             "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", \
-            disable_all_traffic, enterprise_enabled, openid_display_name FROM instance ORDER BY name ASC;"
+            client_traffic_policy, enterprise_enabled, openid_display_name \
+            FROM instance ORDER BY name ASC;"
         )
         .fetch_all(executor)
         .await?;
@@ -88,7 +92,8 @@ impl Instance<Id> {
         let instance = query_as!(
             Self,
             "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token \"token?\", \
-            disable_all_traffic, enterprise_enabled, openid_display_name FROM instance WHERE id = $1;",
+            client_traffic_policy, enterprise_enabled, openid_display_name \
+            FROM instance WHERE id = $1;",
             id
         )
         .fetch_optional(executor)
@@ -122,7 +127,8 @@ impl Instance<Id> {
         let instances = query_as!(
             Self,
             "SELECT id \"id: _\", name, uuid, url, proxy_url, username, token, \
-            disable_all_traffic, enterprise_enabled, openid_display_name FROM instance
+            client_traffic_policy, enterprise_enabled, openid_display_name \
+            FROM instance \
             WHERE token IS NOT NULL ORDER BY name ASC;"
         )
         .fetch_all(executor)
@@ -134,12 +140,13 @@ impl Instance<Id> {
 // This compares proto::InstanceInfo, not to be confused with regular InstanceInfo defined below
 impl PartialEq<proto::InstanceInfo> for Instance<Id> {
     fn eq(&self, other: &proto::InstanceInfo) -> bool {
+        let other_policy = ClientTrafficPolicy::from(other);
         self.name == other.name
             && self.uuid == other.id
             && self.url == other.url
             && self.proxy_url == other.proxy_url
             && self.username == other.username
-            && self.disable_all_traffic == other.disable_all_traffic
+            && self.client_traffic_policy == other_policy
             && self.enterprise_enabled == other.enterprise_enabled
             && self.openid_display_name == other.openid_display_name
     }
@@ -154,7 +161,7 @@ impl Instance<NoId> {
         let proxy_url = self.proxy_url.clone();
         let result = query!(
             "INSERT INTO instance (name, uuid, url, proxy_url, username, token, \
-            disable_all_traffic, enterprise_enabled) \
+            client_traffic_policy , enterprise_enabled) \
             VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id;",
             self.name,
             self.uuid,
@@ -162,7 +169,7 @@ impl Instance<NoId> {
             proxy_url,
             self.username,
             self.token,
-            self.disable_all_traffic,
+            self.client_traffic_policy,
             self.enterprise_enabled
         )
         .fetch_one(executor)
@@ -175,7 +182,7 @@ impl Instance<NoId> {
             proxy_url: self.proxy_url,
             username: self.username,
             token: self.token,
-            disable_all_traffic: self.disable_all_traffic,
+            client_traffic_policy: self.client_traffic_policy,
             enterprise_enabled: self.enterprise_enabled,
             openid_display_name: self.openid_display_name,
         })
@@ -191,7 +198,7 @@ pub struct InstanceInfo<I = NoId> {
     pub proxy_url: String,
     pub active: bool,
     pub pubkey: String,
-    pub disable_all_traffic: bool,
+    pub client_traffic_policy: ClientTrafficPolicy,
     pub enterprise_enabled: bool,
     pub openid_display_name: Option<String>,
 }
@@ -201,3 +208,56 @@ impl fmt::Display for InstanceInfo<Id> {
         write!(f, "{}(ID: {})", self.name, self.id)
     }
 }
+
+/// Describes allowed traffic options for clients connecting to an instance.
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq, Hash, Type)]
+#[repr(u32)]
+#[serde(rename_all = "snake_case")]
+pub enum ClientTrafficPolicy {
+    /// No restrictions
+    None = 0,
+    /// Clients are not allowed to route all traffic through the VPN.
+    DisableAllTraffic = 1,
+    /// Clients are forced to route all traffic through the VPN.
+    ForceAllTraffic = 2,
+}
+
+/// Retrieves `ClientTrafficPolicy` from `proto::InstanceInfo` while ensuring backwards compatibility
+impl From<&proto::InstanceInfo> for ClientTrafficPolicy {
+    fn from(instance: &proto::InstanceInfo) -> Self {
+        match (
+            instance.client_traffic_policy,
+            #[allow(deprecated)]
+            instance.disable_all_traffic,
+        ) {
+            (Some(policy), _) => ClientTrafficPolicy::from(policy),
+            (None, true) => ClientTrafficPolicy::DisableAllTraffic,
+            (None, false) => ClientTrafficPolicy::None,
+        }
+    }
+}
+
+impl From<i32> for ClientTrafficPolicy {
+    fn from(value: i32) -> Self {
+        match value {
+            1 => ClientTrafficPolicy::DisableAllTraffic,
+            2 => ClientTrafficPolicy::ForceAllTraffic,
+            _ => ClientTrafficPolicy::None,
+        }
+    }
+}
+
+impl From<Option<i32>> for ClientTrafficPolicy {
+    fn from(value: Option<i32>) -> Self {
+        match value {
+            None => Self::None,
+            Some(v) => Self::from(v),
+        }
+    }
+}
+
+impl From<i64> for ClientTrafficPolicy {
+    fn from(value: i64) -> Self {
+        Self::from(value as i32)
+    }
+}
diff --git a/src-tauri/src/enterprise/models/instance.rs b/src-tauri/src/enterprise/models/instance.rs
index 6da45fa0..b0a03437 100644
--- a/src-tauri/src/enterprise/models/instance.rs
+++ b/src-tauri/src/enterprise/models/instance.rs
@@ -1,7 +1,10 @@
 use sqlx::SqliteExecutor;
 
 use crate::{
-    database::models::{instance::Instance, Id},
+    database::models::{
+        instance::{ClientTrafficPolicy, Instance},
+        Id,
+    },
     error::Error,
 };
 
@@ -14,8 +17,7 @@ impl Instance<Id> {
             "Disabling enterprise features for instance {}({})",
             self.name, self.id
         );
-        self.enterprise_enabled = false;
-        self.disable_all_traffic = false;
+        self.client_traffic_policy = ClientTrafficPolicy::None;
         self.save(executor).await?;
         debug!(
             "Disabled enterprise features for instance {}({})",
diff --git a/src/pages/client/pages/ClientInstancePage/components/LocationsList/components/LocationCardRoute/LocationCardRoute.tsx b/src/pages/client/pages/ClientInstancePage/components/LocationsList/components/LocationCardRoute/LocationCardRoute.tsx
index 61cc8032..fa2c6003 100644
--- a/src/pages/client/pages/ClientInstancePage/components/LocationsList/components/LocationCardRoute/LocationCardRoute.tsx
+++ b/src/pages/client/pages/ClientInstancePage/components/LocationsList/components/LocationCardRoute/LocationCardRoute.tsx
@@ -7,7 +7,11 @@ import { useI18nContext } from '../../../../../../../../i18n/i18n-react';
 import { Toggle } from '../../../../../../../../shared/defguard-ui/components/Layout/Toggle/Toggle';
 import type { ToggleOption } from '../../../../../../../../shared/defguard-ui/components/Layout/Toggle/types';
 import { clientApi } from '../../../../../../clientAPI/clientApi';
-import type { CommonWireguardFields, DefguardInstance } from '../../../../../../types';
+import {
+  ClientTrafficPolicy,
+  type CommonWireguardFields,
+  type DefguardInstance,
+} from '../../../../../../types';
 
 type Props = {
   location?: CommonWireguardFields;
@@ -37,25 +41,37 @@ export const LocationCardRoute = ({ location, selectedDefguardInstance }: Props)
       {
         text: LL.pages.client.pages.instancePage.controls.traffic.predefinedTraffic(),
         value: 0,
+        disabled:
+          selectedDefguardInstance?.client_traffic_policy ===
+          ClientTrafficPolicy.FORCE_ALL_TRAFFIC,
       },
       {
         text: LL.pages.client.pages.instancePage.controls.traffic.allTraffic(),
         value: 1,
-        disabled: selectedDefguardInstance?.disable_all_traffic,
+        disabled:
+          selectedDefguardInstance?.client_traffic_policy ===
+          ClientTrafficPolicy.DISABLE_ALL_TRAFFIC,
       },
     ];
     return res;
-  }, [LL.pages, selectedDefguardInstance?.disable_all_traffic]);
+  }, [LL.pages, selectedDefguardInstance?.client_traffic_policy]);
 
+  let selected: number;
+  if (selectedDefguardInstance?.client_traffic_policy === ClientTrafficPolicy.NONE) {
+    selected = Number(location?.route_all_traffic);
+  } else if (
+    selectedDefguardInstance?.client_traffic_policy ===
+    ClientTrafficPolicy.DISABLE_ALL_TRAFFIC
+  ) {
+    selected = 0;
+  } else {
+    selected = 1;
+  }
   return (
     <Toggle
       className="location-traffic-toggle"
       options={toggleOptions}
-      selected={
-        selectedDefguardInstance?.disable_all_traffic
-          ? 0
-          : Number(location?.route_all_traffic)
-      }
+      selected={selected}
       disabled={location?.active}
       onChange={(v) => {
         if (!location?.active) {
diff --git a/src/pages/client/types.ts b/src/pages/client/types.ts
index 26f32900..3434187b 100644
--- a/src/pages/client/types.ts
+++ b/src/pages/client/types.ts
@@ -1,3 +1,9 @@
+export enum ClientTrafficPolicy {
+  NONE = 'none',
+  DISABLE_ALL_TRAFFIC = 'disable_all_traffic',
+  FORCE_ALL_TRAFFIC = 'force_all_traffic',
+}
+
 export type DefguardInstance = {
   id: number;
   uuid: string;
@@ -7,7 +13,7 @@ export type DefguardInstance = {
   // connected
   active: boolean;
   pubkey: string;
-  disable_all_traffic: boolean;
+  client_traffic_policy: ClientTrafficPolicy;
   openid_display_name?: string;
 };