diff --git a/wgengine/ifconfig_windows.go b/wgengine/ifconfig_windows.go
index e4b082305..b339261b9 100644
--- a/wgengine/ifconfig_windows.go
+++ b/wgengine/ifconfig_windows.go
@@ -72,7 +72,7 @@ func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLu
 	return nil
 }
 
-func MonitorDefaultRoutes(device *device.Device, autoMTU bool, tun *tun.NativeTun) (*winipcfg.RouteChangeCallback, error) {
+func monitorDefaultRoutes(device *device.Device, autoMTU bool, tun *tun.NativeTun) (*winipcfg.RouteChangeCallback, error) {
 	guid := tun.GUID()
 	ourLuid, err := winipcfg.InterfaceGuidToLuid(&guid)
 	lastLuid4 := uint64(0)
@@ -237,7 +237,7 @@ func setFirewall(ifcGUID *windows.GUID) (bool, error) {
 	return false, nil
 }
 
-func ConfigureInterface(m *wgcfg.Config, tun *tun.NativeTun, dns []wgcfg.IP, dnsDomains []string) error {
+func configureInterface(m *wgcfg.Config, tun *tun.NativeTun, dns []wgcfg.IP, dnsDomains []string) error {
 	const mtu = 0
 	guid := tun.GUID()
 	log.Printf("wintun GUID is %v\n", guid)
diff --git a/wgengine/router_windows.go b/wgengine/router_windows.go
index ac073b192..bfd10c9ac 100644
--- a/wgengine/router_windows.go
+++ b/wgengine/router_windows.go
@@ -40,7 +40,7 @@ func (r *winRouter) Up() error {
 	// MonitorDefaultRoutes handles making sure our wireguard UDP
 	// traffic goes through the old route, not recursively through the VPN.
 	var err error
-	r.routeChangeCallback, err = MonitorDefaultRoutes(r.wgdev, true, r.nativeTun)
+	r.routeChangeCallback, err = monitorDefaultRoutes(r.wgdev, true, r.nativeTun)
 	if err != nil {
 		log.Fatalf("MonitorDefaultRoutes: %v\n", err)
 	}
@@ -48,7 +48,7 @@ func (r *winRouter) Up() error {
 }
 
 func (r *winRouter) SetRoutes(rs RouteSettings) error {
-	err := ConfigureInterface(rs.Cfg, r.nativeTun, rs.DNS, rs.DNSDomains)
+	err := configureInterface(rs.Cfg, r.nativeTun, rs.DNS, rs.DNSDomains)
 	if err != nil {
 		r.logf("ConfigureInterface: %v\n", err)
 		return err