Protective DNS for rail staff, depots and onboard passenger WiFi
A train operator runs staff handhelds, depot networks, station systems and passenger WiFi on trains that rely on metered cellular backhaul. Shield answers each DNS lookup and blocks phishing, malware and command-and-control callbacks before they connect. On board, blocking ads and trackers cuts data used by up to 44%, so the same backhaul carries more passengers. Depots and stations get threat-first rules on the same platform.
- Anycast node 1
- Anycast node 2Offline
- Anycast node 3
What is at stake
From the depot to the carriage
Staff handhelds and tablets
Guards' ticketing handhelds and driver tablets connect from trains, stations and depots. A phishing link opened on one reaches the accounts behind it.Metered backhaul spent on ads
Onboard WiFi runs over cellular links billed by the gigabyte. Ads, trackers and autoplay video spend that data before passengers see a page.Depot and station systems
Maintenance laptops, CCTV and customer information screens sit on networks few people watch. An infected device calling home can sit there unnoticed.
How Shield fits
A policy for each part of the railway
- Onboard passenger WiFiFamily-safe categories, Safe Search and ad blocking to cut data on cellular backhaul. Nothing to install on passenger devices.
- Staff handheldsThreat defence and only the apps each role needs, on staff WiFi at depots, stations and on board.
- Depots and maintenanceThreat-first rules with new-domain blocking, and a relay so each laptop and controller shows its own IP.
- Station screens and CCTVLocked to the domains each system needs, with geographic and TLD blocking on top.
Ads, trackers and bloatware load on every page
Ads and trackers stripped before they load
Proof
Less data spent on the onboard backhaul
- 44%
- less data used once ads and trackers are blocked
- 20-40%
- less web traffic with ads and trackers blocked, in Purple's own measurements
- 62%
- maximum reduction in DNS queries over the same link
- 10 days
- earlier warning of new malicious domains than standard blocklists
FAQ
Questions we hear from teams like yours
How much data does ad blocking save on cellular backhaul?
In Purple's own measurements, blocking ads and trackers cuts data used by up to 44% and web traffic by 20 to 40%. On a metered link, that is backhaul spent on what passengers came for, not adverts. Pages also load up to 500% faster.
Does filtering add delay on a train with patchy signal?
Shield works at the DNS lookup, which a device makes anyway before it connects. Blocking ads and trackers removes requests rather than adding them, with up to 62% fewer DNS queries, so less has to cross a weak or busy link.
What happens if Shield has an outage?
Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. It fails closed, so an outage never leaves passenger or staff networks unfiltered. Your onboard router and firewall stay in place, with Shield as a layer behind them.
Do we need hardware fitted to each train?
No. Point the onboard router or DHCP at Shield and the carriage network is covered, with no appliance to fit during a depot visit. Use a relay where depot VLANs need each device's internal IP in the reports.
Can we evidence our controls for NIS assessments?
Shield gives you evidence for them. Dashboards drill down from a domain to each device that looked it up, scheduled PDF reports go to your security team, and logs stream to Splunk, Microsoft Sentinel or syslog. It helps you meet the NCSC Cyber Assessment Framework. It does not make you compliant on its own.
Other industries
Airports
Threat defence for airport operations and staff, with family-safe passenger WiFi proven at AGS Airports.Airlines
Threat defence for airline offices, crew rooms and outstations, plus family-safe lounge WiFi.Ferries
Threat defence for ferry crews and port offices, with passenger WiFi that spends less satellite data.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.