diff --git a/quic/core/chlo_extractor.h b/quic/core/chlo_extractor.h
index 3cf0d24..4562d84 100644
--- a/quic/core/chlo_extractor.h
+++ b/quic/core/chlo_extractor.h
@@ -12,9 +12,9 @@
 
 // A utility for extracting QUIC Client Hello messages from packets,
 // without needs to spin up a full QuicSession.
-class ChloExtractor {
+class QUIC_EXPORT_PRIVATE ChloExtractor {
  public:
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() {}
 
diff --git a/quic/core/congestion_control/bandwidth_sampler.h b/quic/core/congestion_control/bandwidth_sampler.h
index 5bbb6ba..b27e3a1 100644
--- a/quic/core/congestion_control/bandwidth_sampler.h
+++ b/quic/core/congestion_control/bandwidth_sampler.h
@@ -289,7 +289,7 @@
   // and the state of the connection at the moment the packet was sent,
   // specifically the information about the most recently acknowledged packet at
   // that moment.
-  struct ConnectionStateOnSentPacket {
+  struct QUIC_EXPORT_PRIVATE ConnectionStateOnSentPacket {
     // Time at which the packet is sent.
     QuicTime sent_time;
 
diff --git a/quic/core/congestion_control/bbr2_drain.h b/quic/core/congestion_control/bbr2_drain.h
index 546962b..ccc0320 100644
--- a/quic/core/congestion_control/bbr2_drain.h
+++ b/quic/core/congestion_control/bbr2_drain.h
@@ -32,7 +32,7 @@
 
   bool IsProbingForBandwidth() const override { return false; }
 
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     QuicByteCount drain_target;
   };
 
diff --git a/quic/core/congestion_control/bbr2_probe_bw.h b/quic/core/congestion_control/bbr2_probe_bw.h
index 407056b..429b6fe 100644
--- a/quic/core/congestion_control/bbr2_probe_bw.h
+++ b/quic/core/congestion_control/bbr2_probe_bw.h
@@ -42,7 +42,7 @@
 
   static const char* CyclePhaseToString(CyclePhase phase);
 
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     CyclePhase phase;
     QuicTime cycle_start_time = QuicTime::Zero();
     QuicTime phase_start_time = QuicTime::Zero();
@@ -102,7 +102,7 @@
   void RaiseInflightHighSlope();
   void ProbeInflightHighUpward(const Bbr2CongestionEvent& congestion_event);
 
-  struct Cycle {
+  struct QUIC_EXPORT_PRIVATE Cycle {
     QuicTime cycle_start_time = QuicTime::Zero();
     CyclePhase phase = CyclePhase::PROBE_NOT_STARTED;
     uint64_t rounds_in_phase = 0;
diff --git a/quic/core/congestion_control/bbr2_probe_rtt.h b/quic/core/congestion_control/bbr2_probe_rtt.h
index 811c646..c112a33 100644
--- a/quic/core/congestion_control/bbr2_probe_rtt.h
+++ b/quic/core/congestion_control/bbr2_probe_rtt.h
@@ -30,7 +30,7 @@
 
   bool IsProbingForBandwidth() const override { return false; }
 
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     QuicByteCount inflight_target;
     QuicTime exit_time = QuicTime::Zero();
   };
diff --git a/quic/core/congestion_control/bbr2_sender.h b/quic/core/congestion_control/bbr2_sender.h
index 79239a2..74efc89 100644
--- a/quic/core/congestion_control/bbr2_sender.h
+++ b/quic/core/congestion_control/bbr2_sender.h
@@ -97,7 +97,7 @@
     return cwnd_limits().Min();
   }
 
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     Bbr2Mode mode;
 
     // Shared states.
diff --git a/quic/core/congestion_control/bbr2_startup.h b/quic/core/congestion_control/bbr2_startup.h
index df3f9a7..489bd55 100644
--- a/quic/core/congestion_control/bbr2_startup.h
+++ b/quic/core/congestion_control/bbr2_startup.h
@@ -35,7 +35,7 @@
 
   bool FullBandwidthReached() const { return full_bandwidth_reached_; }
 
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     bool full_bandwidth_reached;
     QuicBandwidth full_bandwidth_baseline = QuicBandwidth::Zero();
     QuicRoundTripCount round_trips_without_bandwidth_growth;
diff --git a/quic/core/congestion_control/bbr_sender.h b/quic/core/congestion_control/bbr_sender.h
index 8321b8c..b4baa2f 100644
--- a/quic/core/congestion_control/bbr_sender.h
+++ b/quic/core/congestion_control/bbr_sender.h
@@ -62,7 +62,7 @@
 
   // Debug state can be exported in order to troubleshoot potential congestion
   // control issues.
-  struct DebugState {
+  struct QUIC_EXPORT_PRIVATE DebugState {
     explicit DebugState(const BbrSender& sender);
     DebugState(const DebugState& state);
 
diff --git a/quic/core/congestion_control/windowed_filter.h b/quic/core/congestion_control/windowed_filter.h
index 8729895..4176d73 100644
--- a/quic/core/congestion_control/windowed_filter.h
+++ b/quic/core/congestion_control/windowed_filter.h
@@ -38,14 +38,14 @@
 // Compares two values and returns true if the first is less than or equal
 // to the second.
 template <class T>
-struct MinFilter {
+struct QUIC_EXPORT_PRIVATE MinFilter {
   bool operator()(const T& lhs, const T& rhs) const { return lhs <= rhs; }
 };
 
 // Compares two values and returns true if the first is greater than or equal
 // to the second.
 template <class T>
-struct MaxFilter {
+struct QUIC_EXPORT_PRIVATE MaxFilter {
   bool operator()(const T& lhs, const T& rhs) const { return lhs >= rhs; }
 };
 
@@ -63,7 +63,7 @@
 //    two timestamps.  Has to be the type of (a - b) if both |a| and |b| are
 //    of type TimeT.
 template <class T, class Compare, typename TimeT, typename TimeDeltaT>
-class WindowedFilter {
+class QUIC_EXPORT_PRIVATE WindowedFilter {
  public:
   // |window_length| is the period after which a best estimate expires.
   // |zero_value| is used as the uninitialized value for objects of T.
@@ -143,7 +143,7 @@
   T GetThirdBest() const { return estimates_[2].sample; }
 
  private:
-  struct Sample {
+  struct QUIC_EXPORT_PRIVATE Sample {
     T sample;
     TimeT time;
     Sample(T init_sample, TimeT init_time)
diff --git a/quic/core/crypto/crypto_utils.h b/quic/core/crypto/crypto_utils.h
index cb02dd7..da746e3 100644
--- a/quic/core/crypto/crypto_utils.h
+++ b/quic/core/crypto/crypto_utils.h
@@ -32,7 +32,7 @@
   // Diversification is a utility class that's used to act like a union type.
   // Values can be created by calling the functions like |NoDiversification|,
   // below.
-  class Diversification {
+  class QUIC_EXPORT_PRIVATE Diversification {
    public:
     enum Mode {
       NEVER,  // Key diversification will never be used. Forward secure
diff --git a/quic/core/crypto/key_exchange.h b/quic/core/crypto/key_exchange.h
index c695523..127dc62 100644
--- a/quic/core/crypto/key_exchange.h
+++ b/quic/core/crypto/key_exchange.h
@@ -25,7 +25,7 @@
 
   // Callback base class for receiving the results of an async call to
   // CalculateSharedKeys.
-  class Callback {
+  class QUIC_EXPORT_PRIVATE Callback {
    public:
     Callback() = default;
     virtual ~Callback() = default;
diff --git a/quic/core/crypto/proof_source.h b/quic/core/crypto/proof_source.h
index fd89098..f774efc 100644
--- a/quic/core/crypto/proof_source.h
+++ b/quic/core/crypto/proof_source.h
@@ -37,13 +37,13 @@
 
   // Details is an abstract class which acts as a container for any
   // implementation-specific details that a ProofSource wants to return.
-  class Details {
+  class QUIC_EXPORT_PRIVATE Details {
    public:
     virtual ~Details() {}
   };
 
   // Callback base class for receiving the results of an async call to GetProof.
-  class Callback {
+  class QUIC_EXPORT_PRIVATE Callback {
    public:
     Callback() {}
     virtual ~Callback() {}
@@ -74,7 +74,7 @@
   };
 
   // Base class for signalling the completion of a call to ComputeTlsSignature.
-  class SignatureCallback {
+  class QUIC_EXPORT_PRIVATE SignatureCallback {
    public:
     SignatureCallback() {}
     virtual ~SignatureCallback() = default;
diff --git a/quic/core/crypto/quic_compressed_certs_cache.h b/quic/core/crypto/quic_compressed_certs_cache.h
index 2003187..586ea88 100644
--- a/quic/core/crypto/quic_compressed_certs_cache.h
+++ b/quic/core/crypto/quic_compressed_certs_cache.h
@@ -52,7 +52,7 @@
   // A wrapper of the tuple:
   //   |chain, client_common_set_hashes, client_cached_cert_hashes|
   // to identify uncompressed representation of certs.
-  struct UncompressedCerts {
+  struct QUIC_EXPORT_PRIVATE UncompressedCerts {
     UncompressedCerts();
     UncompressedCerts(
         const QuicReferenceCountedPointer<ProofSource::Chain>& chain,
@@ -68,7 +68,7 @@
   // Certs stored by QuicCompressedCertsCache where uncompressed certs data is
   // used to identify the uncompressed representation of certs and
   // |compressed_cert| is the cached compressed representation.
-  class CachedCerts {
+  class QUIC_EXPORT_PRIVATE CachedCerts {
    public:
     CachedCerts();
     CachedCerts(const UncompressedCerts& uncompressed_certs,
diff --git a/quic/core/crypto/quic_crypto_client_config.h b/quic/core/crypto/quic_crypto_client_config.h
index 838b2ee..d3e627d 100644
--- a/quic/core/crypto/quic_crypto_client_config.h
+++ b/quic/core/crypto/quic_crypto_client_config.h
@@ -195,7 +195,7 @@
   };
 
   // Used to filter server ids for partial config deletion.
-  class ServerIdFilter {
+  class QUIC_EXPORT_PRIVATE ServerIdFilter {
    public:
     virtual ~ServerIdFilter() {}
 
diff --git a/quic/core/crypto/quic_crypto_server_config.h b/quic/core/crypto/quic_crypto_server_config.h
index 3fb424d..809ebae 100644
--- a/quic/core/crypto/quic_crypto_server_config.h
+++ b/quic/core/crypto/quic_crypto_server_config.h
@@ -41,7 +41,7 @@
 
 // ClientHelloInfo contains information about a client hello message that is
 // only kept for as long as it's being processed.
-struct ClientHelloInfo {
+struct QUIC_EXPORT_PRIVATE ClientHelloInfo {
   ClientHelloInfo(const QuicIpAddress& in_client_ip, QuicWallTime in_now);
   ClientHelloInfo(const ClientHelloInfo& other);
   ~ClientHelloInfo();
@@ -68,7 +68,7 @@
 }  // namespace test
 
 // Hook that allows application code to subscribe to primary config changes.
-class PrimaryConfigChangedCallback {
+class QUIC_EXPORT_PRIVATE PrimaryConfigChangedCallback {
  public:
   PrimaryConfigChangedCallback();
   PrimaryConfigChangedCallback(const PrimaryConfigChangedCallback&) = delete;
@@ -128,7 +128,7 @@
 
 // Callback used to receive the results of a call to
 // BuildServerConfigUpdateMessage.
-class BuildServerConfigUpdateMessageResultCallback {
+class QUIC_EXPORT_PRIVATE BuildServerConfigUpdateMessageResultCallback {
  public:
   BuildServerConfigUpdateMessageResultCallback() = default;
   virtual ~BuildServerConfigUpdateMessageResultCallback() {}
@@ -141,7 +141,7 @@
 
 // Object that is interested in built rejections (which include REJ, SREJ and
 // cheap SREJ).
-class RejectionObserver {
+class QUIC_EXPORT_PRIVATE RejectionObserver {
  public:
   RejectionObserver() = default;
   virtual ~RejectionObserver() {}
@@ -511,7 +511,7 @@
       QUIC_SHARED_LOCKS_REQUIRED(configs_lock_);
 
   // A snapshot of the configs associated with an in-progress handshake.
-  struct Configs {
+  struct QUIC_EXPORT_PRIVATE Configs {
     QuicReferenceCountedPointer<Config> requested;
     QuicReferenceCountedPointer<Config> primary;
     QuicReferenceCountedPointer<Config> fallback;
@@ -552,7 +552,7 @@
 
   // Convenience class which carries the arguments passed to
   // |ProcessClientHellp| along.
-  class ProcessClientHelloContext {
+  class QUIC_EXPORT_PRIVATE ProcessClientHelloContext {
    public:
     ProcessClientHelloContext(
         QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result>
diff --git a/quic/core/crypto/quic_hkdf.h b/quic/core/crypto/quic_hkdf.h
index 09006ee..94d45bc 100644
--- a/quic/core/crypto/quic_hkdf.h
+++ b/quic/core/crypto/quic_hkdf.h
@@ -15,7 +15,7 @@
 // QuicHKDF implements the key derivation function specified in RFC 5869
 // (using SHA-256) and outputs key material, as needed by QUIC.
 // See https://tools.ietf.org/html/rfc5869 for details.
-class QUIC_EXPORT QuicHKDF {
+class QUIC_EXPORT_PRIVATE QuicHKDF {
  public:
   // |secret|: the input shared secret (or, from RFC 5869, the IKM).
   // |salt|: an (optional) public salt / non-secret random value. While
diff --git a/quic/core/crypto/tls_client_connection.h b/quic/core/crypto/tls_client_connection.h
index a9212ff..6660343 100644
--- a/quic/core/crypto/tls_client_connection.h
+++ b/quic/core/crypto/tls_client_connection.h
@@ -15,7 +15,7 @@
  public:
   // A TlsClientConnection::Delegate implements the client-specific methods that
   // are set as callbacks for an SSL object.
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() {}
 
diff --git a/quic/core/crypto/tls_connection.h b/quic/core/crypto/tls_connection.h
index 4774ba6..fd4f64b 100644
--- a/quic/core/crypto/tls_connection.h
+++ b/quic/core/crypto/tls_connection.h
@@ -26,7 +26,7 @@
  public:
   // A TlsConnection::Delegate implements the methods that are set as callbacks
   // of TlsConnection.
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() {}
 
diff --git a/quic/core/crypto/tls_server_connection.h b/quic/core/crypto/tls_server_connection.h
index 0e78d1b..96d71e2 100644
--- a/quic/core/crypto/tls_server_connection.h
+++ b/quic/core/crypto/tls_server_connection.h
@@ -15,7 +15,7 @@
  public:
   // A TlsServerConnection::Delegate implement the server-specific methods that
   // are set as callbacks for an SSL object.
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() {}
 
diff --git a/quic/core/http/http_frames.h b/quic/core/http/http_frames.h
index dde8b1e..215fa56 100644
--- a/quic/core/http/http_frames.h
+++ b/quic/core/http/http_frames.h
@@ -34,7 +34,7 @@
 //
 //   DATA frames (type=0x0) convey arbitrary, variable-length sequences of
 //   octets associated with an HTTP request or response payload.
-struct DataFrame {
+struct QUIC_EXPORT_PRIVATE DataFrame {
   QuicStringPiece data;
 };
 
@@ -42,7 +42,7 @@
 //
 //   The HEADERS frame (type=0x1) is used to carry a header block,
 //   compressed using QPACK.
-struct HeadersFrame {
+struct QUIC_EXPORT_PRIVATE HeadersFrame {
   QuicStringPiece headers;
 };
 
@@ -65,7 +65,7 @@
   ROOT_OF_TREE = 3
 };
 
-struct PriorityFrame {
+struct QUIC_EXPORT_PRIVATE PriorityFrame {
   PriorityElementType prioritized_type = REQUEST_STREAM;
   PriorityElementType dependency_type = REQUEST_STREAM;
   bool exclusive = false;
@@ -103,7 +103,7 @@
 //   server push prior to the push stream being created.
 using PushId = uint64_t;
 
-struct CancelPushFrame {
+struct QUIC_EXPORT_PRIVATE CancelPushFrame {
   PushId push_id;
 
   bool operator==(const CancelPushFrame& rhs) const {
@@ -119,7 +119,7 @@
 
 using SettingsMap = std::map<uint64_t, uint64_t>;
 
-struct SettingsFrame {
+struct QUIC_EXPORT_PRIVATE SettingsFrame {
   SettingsMap values;
 
   bool operator==(const SettingsFrame& rhs) const {
@@ -148,7 +148,7 @@
 //
 //   The PUSH_PROMISE frame (type=0x05) is used to carry a request header
 //   set from server to client, as in HTTP/2.
-struct PushPromiseFrame {
+struct QUIC_EXPORT_PRIVATE PushPromiseFrame {
   PushId push_id;
   QuicStringPiece headers;
 
@@ -161,7 +161,7 @@
 //
 //   The GOAWAY frame (type=0x7) is used to initiate graceful shutdown of
 //   a connection by a server.
-struct GoAwayFrame {
+struct QUIC_EXPORT_PRIVATE GoAwayFrame {
   QuicStreamId stream_id;
 
   bool operator==(const GoAwayFrame& rhs) const {
@@ -173,7 +173,7 @@
 //
 //   The MAX_PUSH_ID frame (type=0xD) is used by clients to control the
 //   number of server pushes that the server can initiate.
-struct MaxPushIdFrame {
+struct QUIC_EXPORT_PRIVATE MaxPushIdFrame {
   PushId push_id;
 
   bool operator==(const MaxPushIdFrame& rhs) const {
@@ -186,7 +186,7 @@
 //  The DUPLICATE_PUSH frame (type=0xE) is used by servers to indicate
 //  that an existing pushed resource is related to multiple client
 //  requests.
-struct DuplicatePushFrame {
+struct QUIC_EXPORT_PRIVATE DuplicatePushFrame {
   PushId push_id;
 
   bool operator==(const DuplicatePushFrame& rhs) const {
diff --git a/quic/core/http/quic_client_promised_info.h b/quic/core/http/quic_client_promised_info.h
index bf61405..9268940 100644
--- a/quic/core/http/quic_client_promised_info.h
+++ b/quic/core/http/quic_client_promised_info.h
@@ -84,7 +84,7 @@
  private:
   friend class test::QuicClientPromisedInfoPeer;
 
-  class CleanupAlarm : public QuicAlarm::Delegate {
+  class QUIC_EXPORT_PRIVATE CleanupAlarm : public QuicAlarm::Delegate {
    public:
     explicit CleanupAlarm(QuicClientPromisedInfo* promised)
         : promised_(promised) {}
diff --git a/quic/core/http/quic_spdy_client_session.h b/quic/core/http/quic_spdy_client_session.h
index 3611c69..dde3e5d 100644
--- a/quic/core/http/quic_spdy_client_session.h
+++ b/quic/core/http/quic_spdy_client_session.h
@@ -20,7 +20,8 @@
 class QuicConnection;
 class QuicServerId;
 
-class QuicSpdyClientSession : public QuicSpdyClientSessionBase {
+class QUIC_EXPORT_PRIVATE QuicSpdyClientSession
+    : public QuicSpdyClientSessionBase {
  public:
   // Takes ownership of |connection|. Caller retains ownership of
   // |promised_by_url|.
diff --git a/quic/core/http/quic_spdy_client_stream.h b/quic/core/http/quic_spdy_client_stream.h
index 9c94b70..2ebf8b0 100644
--- a/quic/core/http/quic_spdy_client_stream.h
+++ b/quic/core/http/quic_spdy_client_stream.h
@@ -19,7 +19,7 @@
 
 // All this does right now is send an SPDY request, and aggregate the
 // SPDY response.
-class QuicSpdyClientStream : public QuicSpdyStream {
+class QUIC_EXPORT_PRIVATE QuicSpdyClientStream : public QuicSpdyStream {
  public:
   QuicSpdyClientStream(QuicStreamId id,
                        QuicSpdyClientSession* session,
diff --git a/quic/core/http/quic_spdy_server_stream_base.h b/quic/core/http/quic_spdy_server_stream_base.h
index ad0d326..24d0f13 100644
--- a/quic/core/http/quic_spdy_server_stream_base.h
+++ b/quic/core/http/quic_spdy_server_stream_base.h
@@ -9,7 +9,7 @@
 
 namespace quic {
 
-class QuicSpdyServerStreamBase : public QuicSpdyStream {
+class QUIC_EXPORT_PRIVATE QuicSpdyServerStreamBase : public QuicSpdyStream {
  public:
   QuicSpdyServerStreamBase(QuicStreamId id,
                            QuicSpdySession* session,
diff --git a/quic/core/http/quic_spdy_stream_body_manager.h b/quic/core/http/quic_spdy_stream_body_manager.h
index 6b2dd62..1942c26 100644
--- a/quic/core/http/quic_spdy_stream_body_manager.h
+++ b/quic/core/http/quic_spdy_stream_body_manager.h
@@ -77,7 +77,7 @@
   // A Fragment instance represents a body fragment with a count of bytes
   // received afterwards but before the next body fragment that can be marked
   // consumed as soon as all of the body fragment is read.
-  struct Fragment {
+  struct QUIC_EXPORT_PRIVATE Fragment {
     // |body| must not be empty.
     QuicStringPiece body;
     // Might be zero.
diff --git a/quic/core/packet_number_indexed_queue.h b/quic/core/packet_number_indexed_queue.h
index 695ff7d..83e3d88 100644
--- a/quic/core/packet_number_indexed_queue.h
+++ b/quic/core/packet_number_indexed_queue.h
@@ -35,7 +35,7 @@
 // Because of that, it is not a general-purpose container and should not be used
 // as one.
 template <typename T>
-class PacketNumberIndexedQueue {
+class QUIC_EXPORT_PRIVATE PacketNumberIndexedQueue {
  public:
   PacketNumberIndexedQueue() : number_of_present_entries_(0) {}
 
@@ -86,7 +86,7 @@
 
  private:
   // Wrapper around T used to mark whether the entry is actually in the map.
-  struct EntryWrapper : T {
+  struct QUIC_EXPORT_PRIVATE EntryWrapper : T {
     bool present;
 
     EntryWrapper() : present(false) {}
diff --git a/quic/core/qpack/offline/qpack_offline_decoder.h b/quic/core/qpack/offline/qpack_offline_decoder.h
index c12c491..ecaebc8 100644
--- a/quic/core/qpack/offline/qpack_offline_decoder.h
+++ b/quic/core/qpack/offline/qpack_offline_decoder.h
@@ -19,7 +19,8 @@
 // a list of expected header lists read from another file.  File format is
 // described at
 // https://github.com/quicwg/base-drafts/wiki/QPACK-Offline-Interop.
-class QpackOfflineDecoder : public QpackDecoder::EncoderStreamErrorDelegate {
+class QUIC_EXPORT_PRIVATE QpackOfflineDecoder
+    : public QpackDecoder::EncoderStreamErrorDelegate {
  public:
   QpackOfflineDecoder();
   ~QpackOfflineDecoder() override = default;
@@ -39,7 +40,7 @@
   // Data structure to hold TestHeadersHandler and QpackProgressiveDecoder until
   // decoding of a header header block (and all preceding header blocks) is
   // complete.
-  struct Decoder {
+  struct QUIC_EXPORT_PRIVATE Decoder {
     std::unique_ptr<test::TestHeadersHandler> headers_handler;
     std::unique_ptr<QpackProgressiveDecoder> progressive_decoder;
     uint64_t stream_id;
diff --git a/quic/core/qpack/qpack_decoded_headers_accumulator.h b/quic/core/qpack/qpack_decoded_headers_accumulator.h
index c649322..93c5621 100644
--- a/quic/core/qpack/qpack_decoded_headers_accumulator.h
+++ b/quic/core/qpack/qpack_decoded_headers_accumulator.h
@@ -37,7 +37,7 @@
   // Visitor interface used for blocked decoding.  Exactly one visitor method
   // will be called if EndHeaderBlock() returned kBlocked.  No visitor method
   // will be called if EndHeaderBlock() returned any other value.
-  class Visitor {
+  class QUIC_EXPORT_PRIVATE Visitor {
    public:
     virtual ~Visitor() = default;
 
diff --git a/quic/core/qpack/qpack_decoder_stream_receiver.h b/quic/core/qpack/qpack_decoder_stream_receiver.h
index 6071939..396c6df 100644
--- a/quic/core/qpack/qpack_decoder_stream_receiver.h
+++ b/quic/core/qpack/qpack_decoder_stream_receiver.h
@@ -23,7 +23,7 @@
  public:
   // An interface for handling instructions decoded from the decoder stream, see
   // https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html#rfc.section.5.3
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() = default;
 
diff --git a/quic/core/qpack/qpack_encoder.h b/quic/core/qpack/qpack_encoder.h
index 1ed56a8..22232e6 100644
--- a/quic/core/qpack/qpack_encoder.h
+++ b/quic/core/qpack/qpack_encoder.h
@@ -95,7 +95,7 @@
   // changing QpackInstructionEncoder::Encoder() to take an
   // InstructionWithValues struct instead of separate |instruction| and |values|
   // arguments.
-  struct InstructionWithValues {
+  struct QUIC_EXPORT_PRIVATE InstructionWithValues {
     // |instruction| is not owned.
     const QpackInstruction* instruction;
     QpackInstructionEncoder::Values values;
diff --git a/quic/core/qpack/qpack_encoder_stream_receiver.h b/quic/core/qpack/qpack_encoder_stream_receiver.h
index 8da3147..b393b54 100644
--- a/quic/core/qpack/qpack_encoder_stream_receiver.h
+++ b/quic/core/qpack/qpack_encoder_stream_receiver.h
@@ -22,7 +22,7 @@
  public:
   // An interface for handling instructions decoded from the encoder stream, see
   // https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html#rfc.section.5.2
-  class Delegate {
+  class QUIC_EXPORT_PRIVATE Delegate {
    public:
     virtual ~Delegate() = default;
 
diff --git a/quic/core/qpack/qpack_header_table.h b/quic/core/qpack/qpack_header_table.h
index 78d85f6..d2650e5 100644
--- a/quic/core/qpack/qpack_header_table.h
+++ b/quic/core/qpack/qpack_header_table.h
@@ -40,7 +40,7 @@
   enum class MatchType { kNameAndValue, kName, kNoMatch };
 
   // Observer interface for dynamic table insertion.
-  class Observer {
+  class QUIC_EXPORT_PRIVATE Observer {
    public:
     virtual ~Observer() = default;
 
diff --git a/quic/core/qpack/qpack_instruction_encoder.h b/quic/core/qpack/qpack_instruction_encoder.h
index 1ca52e6..4f1392a 100644
--- a/quic/core/qpack/qpack_instruction_encoder.h
+++ b/quic/core/qpack/qpack_instruction_encoder.h
@@ -21,7 +21,7 @@
  public:
   // Storage for field values to be encoded.
   // The encoded instruction determines which values are actually used.
-  struct Values {
+  struct QUIC_EXPORT_PRIVATE Values {
     bool s_bit;
     uint64_t varint;
     uint64_t varint2;
diff --git a/quic/core/qpack/qpack_test_utils.h b/quic/core/qpack/qpack_test_utils.h
index 42fa383..7011e88 100644
--- a/quic/core/qpack/qpack_test_utils.h
+++ b/quic/core/qpack/qpack_test_utils.h
@@ -27,7 +27,8 @@
     FragmentMode fragment_mode);
 
 // Mock QpackUnidirectionalStreamSenderDelegate implementation.
-class MockQpackStreamSenderDelegate : public QpackStreamSenderDelegate {
+class QUIC_EXPORT_PRIVATE MockQpackStreamSenderDelegate
+    : public QpackStreamSenderDelegate {
  public:
   ~MockQpackStreamSenderDelegate() override = default;
 
diff --git a/quic/core/quic_arena_scoped_ptr.h b/quic/core/quic_arena_scoped_ptr.h
index 7c20fc7..bb55752 100644
--- a/quic/core/quic_arena_scoped_ptr.h
+++ b/quic/core/quic_arena_scoped_ptr.h
@@ -14,12 +14,13 @@
 #include <cstdint>  // for uintptr_t
 
 #include "net/third_party/quiche/src/quic/platform/api/quic_aligned.h"
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_logging.h"
 
 namespace quic {
 
 template <typename T>
-class QuicArenaScopedPtr {
+class QUIC_EXPORT_PRIVATE QuicArenaScopedPtr {
   static_assert(QUIC_ALIGN_OF(T*) > 1,
                 "QuicArenaScopedPtr can only store objects that are aligned to "
                 "greater than 1 byte.");
diff --git a/quic/core/quic_connection.h b/quic/core/quic_connection.h
index bcd9ff2..bc97119 100644
--- a/quic/core/quic_connection.h
+++ b/quic/core/quic_connection.h
@@ -979,7 +979,7 @@
   // addresses) of those packets which are serialized but failed to send because
   // socket is blocked. From unacked packet map and send algorithm's
   // perspective, buffered packets are treated as sent.
-  struct BufferedPacket {
+  struct QUIC_EXPORT_PRIVATE BufferedPacket {
     BufferedPacket(const SerializedPacket& packet,
                    const QuicSocketAddress& self_address,
                    const QuicSocketAddress& peer_address);
diff --git a/quic/core/quic_connection_id.h b/quic/core/quic_connection_id.h
index 431cc74..25af43d 100644
--- a/quic/core/quic_connection_id.h
+++ b/quic/core/quic_connection_id.h
@@ -127,7 +127,7 @@
 // Note however that this property is not guaranteed across process lifetimes.
 // This makes QuicConnectionIdHash suitable for data structures such as hash
 // tables but not for sending a hash over the network.
-class QuicConnectionIdHash {
+class QUIC_EXPORT_PRIVATE QuicConnectionIdHash {
  public:
   size_t operator()(QuicConnectionId const& connection_id) const noexcept {
     return connection_id.Hash();
diff --git a/quic/core/quic_crypto_client_handshaker.h b/quic/core/quic_crypto_client_handshaker.h
index d33ebfe..f880fb3 100644
--- a/quic/core/quic_crypto_client_handshaker.h
+++ b/quic/core/quic_crypto_client_handshaker.h
@@ -60,7 +60,8 @@
   // ProofVerifierCallbackImpl is passed as the callback method to VerifyProof.
   // The ProofVerifier calls this class with the result of proof verification
   // when verification is performed asynchronously.
-  class ProofVerifierCallbackImpl : public ProofVerifierCallback {
+  class QUIC_EXPORT_PRIVATE ProofVerifierCallbackImpl
+      : public ProofVerifierCallback {
    public:
     explicit ProofVerifierCallbackImpl(QuicCryptoClientHandshaker* parent);
     ~ProofVerifierCallbackImpl() override;
diff --git a/quic/core/quic_crypto_server_handshaker.h b/quic/core/quic_crypto_server_handshaker.h
index b24e9e9..a67ea5e 100644
--- a/quic/core/quic_crypto_server_handshaker.h
+++ b/quic/core/quic_crypto_server_handshaker.h
@@ -91,7 +91,8 @@
  private:
   friend class test::QuicCryptoServerStreamPeer;
 
-  class ValidateCallback : public ValidateClientHelloResultCallback {
+  class QUIC_EXPORT_PRIVATE ValidateCallback
+      : public ValidateClientHelloResultCallback {
    public:
     explicit ValidateCallback(QuicCryptoServerHandshaker* parent);
     ValidateCallback(const ValidateCallback&) = delete;
diff --git a/quic/core/quic_crypto_server_stream.h b/quic/core/quic_crypto_server_stream.h
index 3a7d6e7..e66e55b 100644
--- a/quic/core/quic_crypto_server_stream.h
+++ b/quic/core/quic_crypto_server_stream.h
@@ -125,7 +125,7 @@
     virtual size_t BufferSizeLimitForLevel(EncryptionLevel level) const = 0;
   };
 
-  class Helper {
+  class QUIC_EXPORT_PRIVATE Helper {
    public:
     virtual ~Helper() {}
 
diff --git a/quic/core/quic_crypto_stream.h b/quic/core/quic_crypto_stream.h
index 12a36f8..e38b3f8 100644
--- a/quic/core/quic_crypto_stream.h
+++ b/quic/core/quic_crypto_stream.h
@@ -155,7 +155,7 @@
   // levels. Some of the state for the single logical crypto stream is split
   // across encryption levels, and a CryptoSubstream is used to manage that
   // state for a particular encryption level.
-  struct CryptoSubstream {
+  struct QUIC_EXPORT_PRIVATE CryptoSubstream {
     CryptoSubstream(QuicCryptoStream* crypto_stream, EncryptionLevel);
 
     QuicStreamSequencer sequencer;
diff --git a/quic/core/quic_dispatcher.h b/quic/core/quic_dispatcher.h
index abcd4f2..528d6cf 100644
--- a/quic/core/quic_dispatcher.h
+++ b/quic/core/quic_dispatcher.h
@@ -34,9 +34,10 @@
 class QuicConfig;
 class QuicCryptoServerConfig;
 
-class QuicDispatcher : public QuicTimeWaitListManager::Visitor,
-                       public ProcessPacketInterface,
-                       public QuicBufferedPacketStore::VisitorInterface {
+class QUIC_EXPORT_PRIVATE QuicDispatcher
+    : public QuicTimeWaitListManager::Visitor,
+      public ProcessPacketInterface,
+      public QuicBufferedPacketStore::VisitorInterface {
  public:
   // Ideally we'd have a linked_hash_set: the  boolean is unused.
   typedef QuicLinkedHashMap<QuicBlockedWriterInterface*, bool> WriteBlockedList;
diff --git a/quic/core/quic_epoll_alarm_factory.h b/quic/core/quic_epoll_alarm_factory.h
index fc9b45c..5c04e3d 100644
--- a/quic/core/quic_epoll_alarm_factory.h
+++ b/quic/core/quic_epoll_alarm_factory.h
@@ -13,7 +13,7 @@
 namespace quic {
 
 // Creates alarms that use the supplied EpollServer for timing and firing.
-class QuicEpollAlarmFactory : public QuicAlarmFactory {
+class QUIC_EXPORT_PRIVATE QuicEpollAlarmFactory : public QuicAlarmFactory {
  public:
   explicit QuicEpollAlarmFactory(QuicEpollServer* eps);
   QuicEpollAlarmFactory(const QuicEpollAlarmFactory&) = delete;
diff --git a/quic/core/quic_epoll_connection_helper.h b/quic/core/quic_epoll_connection_helper.h
index 7041454..ce68cfb 100644
--- a/quic/core/quic_epoll_connection_helper.h
+++ b/quic/core/quic_epoll_connection_helper.h
@@ -27,7 +27,8 @@
 
 enum class QuicAllocator { SIMPLE, BUFFER_POOL };
 
-class QuicEpollConnectionHelper : public QuicConnectionHelperInterface {
+class QUIC_EXPORT_PRIVATE QuicEpollConnectionHelper
+    : public QuicConnectionHelperInterface {
  public:
   QuicEpollConnectionHelper(QuicEpollServer* eps, QuicAllocator allocator);
   QuicEpollConnectionHelper(const QuicEpollConnectionHelper&) = delete;
diff --git a/quic/core/quic_error_codes.h b/quic/core/quic_error_codes.h
index 9b3fab2..6008ab6 100644
--- a/quic/core/quic_error_codes.h
+++ b/quic/core/quic_error_codes.h
@@ -362,7 +362,7 @@
     QuicRstStreamErrorCode error);
 
 // Returns the name of the QuicErrorCode as a char*
-QUIC_EXPORT const char* QuicErrorCodeToString(QuicErrorCode error);
+QUIC_EXPORT_PRIVATE const char* QuicErrorCodeToString(QuicErrorCode error);
 
 // Wire values for QPACK errors.
 // https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html#error-code-registration
diff --git a/quic/core/quic_framer.h b/quic/core/quic_framer.h
index 65a0b3b..4e1b11e 100644
--- a/quic/core/quic_framer.h
+++ b/quic/core/quic_framer.h
@@ -645,7 +645,7 @@
 
   typedef std::map<QuicPacketNumber, uint8_t> NackRangeMap;
 
-  struct AckFrameInfo {
+  struct QUIC_EXPORT_PRIVATE AckFrameInfo {
     AckFrameInfo();
     AckFrameInfo(const AckFrameInfo& other);
     ~AckFrameInfo();
diff --git a/quic/core/quic_interval.h b/quic/core/quic_interval.h
index c860e88..272c43d 100644
--- a/quic/core/quic_interval.h
+++ b/quic/core/quic_interval.h
@@ -63,17 +63,19 @@
 #include <utility>
 #include <vector>
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
+
 namespace quic {
 
 template <typename T>
-class QuicInterval {
+class QUIC_EXPORT_PRIVATE QuicInterval {
  private:
   // Type trait for deriving the return type for QuicInterval::Length.  If
   // operator-() is not defined for T, then the return type is void.  This makes
   // the signature for Length compile so that the class can be used for such T,
   // but code that calls Length would still generate a compilation error.
   template <typename U>
-  class DiffTypeOrVoid {
+  class QUIC_EXPORT_PRIVATE DiffTypeOrVoid {
    private:
     template <typename V>
     static auto f(const V* v) -> decltype(*v - *v);
diff --git a/quic/core/quic_interval_set.h b/quic/core/quic_interval_set.h
index 4722528..98ee894 100644
--- a/quic/core/quic_interval_set.h
+++ b/quic/core/quic_interval_set.h
@@ -65,12 +65,12 @@
 namespace quic {
 
 template <typename T>
-class QuicIntervalSet {
+class QUIC_EXPORT_PRIVATE QuicIntervalSet {
  public:
   typedef QuicInterval<T> value_type;
 
  private:
-  struct IntervalLess {
+  struct QUIC_EXPORT_PRIVATE IntervalLess {
     bool operator()(const value_type& a, const value_type& b) const;
   };
   typedef std::set<value_type, IntervalLess> Set;
@@ -320,7 +320,7 @@
 
  private:
   // Simple member-wise equality, since all intervals are non-empty.
-  struct NonemptyIntervalEq {
+  struct QUIC_EXPORT_PRIVATE NonemptyIntervalEq {
     bool operator()(const value_type& a, const value_type& b) const {
       return a.min() == b.min() && a.max() == b.max();
     }
diff --git a/quic/core/quic_lru_cache.h b/quic/core/quic_lru_cache.h
index b8c78c6..4972f9c 100644
--- a/quic/core/quic_lru_cache.h
+++ b/quic/core/quic_lru_cache.h
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "net/third_party/quiche/src/quic/platform/api/quic_containers.h"
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_flag_utils.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_flags.h"
 
@@ -18,7 +19,7 @@
 // Value* returned by Lookup() can be invalid if the entry is evicted by other
 // threads.
 template <class K, class V>
-class QuicLRUCache {
+class QUIC_EXPORT_PRIVATE QuicLRUCache {
  public:
   explicit QuicLRUCache(size_t capacity) : capacity_(capacity) {}
   QuicLRUCache(const QuicLRUCache&) = delete;
diff --git a/quic/core/quic_one_block_arena.h b/quic/core/quic_one_block_arena.h
index c76a70f..41842f3 100644
--- a/quic/core/quic_one_block_arena.h
+++ b/quic/core/quic_one_block_arena.h
@@ -20,7 +20,7 @@
 namespace quic {
 
 template <uint32_t ArenaSize>
-class QuicOneBlockArena {
+class QUIC_EXPORT_PRIVATE QuicOneBlockArena {
   static const uint32_t kMaxAlign = 8;
 
  public:
diff --git a/quic/core/quic_packet_number.h b/quic/core/quic_packet_number.h
index 0cf7f15..066d49c 100644
--- a/quic/core/quic_packet_number.h
+++ b/quic/core/quic_packet_number.h
@@ -85,7 +85,7 @@
   uint64_t packet_number_;
 };
 
-class QuicPacketNumberHash {
+class QUIC_EXPORT_PRIVATE QuicPacketNumberHash {
  public:
   uint64_t operator()(QuicPacketNumber packet_number) const noexcept {
     return packet_number.Hash();
diff --git a/quic/core/quic_packet_reader.h b/quic/core/quic_packet_reader.h
index 1826ef3..1e644aa 100644
--- a/quic/core/quic_packet_reader.h
+++ b/quic/core/quic_packet_reader.h
@@ -25,7 +25,7 @@
 const int kNumPacketsPerReadMmsgCall = 16;
 #endif
 
-class QuicPacketReader {
+class QUIC_EXPORT_PRIVATE QuicPacketReader {
  public:
   QuicPacketReader();
   QuicPacketReader(const QuicPacketReader&) = delete;
@@ -70,7 +70,7 @@
   // from exceeding maximum allowed frame size.
   // packets_ and mmsg_hdr_ are used to supply cbuf and buf to the recvmmsg
   // call.
-  struct PacketData {
+  struct QUIC_EXPORT_PRIVATE PacketData {
     iovec iov;
     // raw_address is used for address information provided by the recvmmsg
     // call on the packets.
diff --git a/quic/core/quic_packet_writer_wrapper.h b/quic/core/quic_packet_writer_wrapper.h
index cc3dbc2..23a737f 100644
--- a/quic/core/quic_packet_writer_wrapper.h
+++ b/quic/core/quic_packet_writer_wrapper.h
@@ -15,7 +15,7 @@
 // Wraps a writer object to allow dynamically extending functionality. Use
 // cases: replace writer while dispatcher and connections hold on to the
 // wrapper; mix in monitoring; mix in mocks in unit tests.
-class QuicPacketWriterWrapper : public QuicPacketWriter {
+class QUIC_EXPORT_PRIVATE QuicPacketWriterWrapper : public QuicPacketWriter {
  public:
   QuicPacketWriterWrapper();
   QuicPacketWriterWrapper(const QuicPacketWriterWrapper&) = delete;
diff --git a/quic/core/quic_process_packet_interface.h b/quic/core/quic_process_packet_interface.h
index fc4257e..1d92a2d 100644
--- a/quic/core/quic_process_packet_interface.h
+++ b/quic/core/quic_process_packet_interface.h
@@ -11,7 +11,7 @@
 namespace quic {
 
 // A class to process each incoming packet.
-class ProcessPacketInterface {
+class QUIC_EXPORT_PRIVATE ProcessPacketInterface {
  public:
   virtual ~ProcessPacketInterface() {}
   virtual void ProcessPacket(const QuicSocketAddress& self_address,
diff --git a/quic/core/quic_session.h b/quic/core/quic_session.h
index d221fe6..fba1e63 100644
--- a/quic/core/quic_session.h
+++ b/quic/core/quic_session.h
@@ -51,7 +51,7 @@
   // An interface from the session to the entity owning the session.
   // This lets the session notify its owner (the Dispatcher) when the connection
   // is closed, blocked, or added/removed from the time-wait list.
-  class Visitor {
+  class QUIC_EXPORT_PRIVATE Visitor {
    public:
     virtual ~Visitor() {}
 
diff --git a/quic/core/quic_stream_id_manager.h b/quic/core/quic_stream_id_manager.h
index 4cb9a88..e39e14f 100644
--- a/quic/core/quic_stream_id_manager.h
+++ b/quic/core/quic_stream_id_manager.h
@@ -29,7 +29,7 @@
 // This class manages the stream ids for Version 99/IETF QUIC.
 class QUIC_EXPORT_PRIVATE QuicStreamIdManager {
  public:
-  class DelegateInterface {
+  class QUIC_EXPORT_PRIVATE DelegateInterface {
    public:
     virtual ~DelegateInterface() = default;
 
diff --git a/quic/core/quic_stream_send_buffer.h b/quic/core/quic_stream_send_buffer.h
index 74e9d0d..f3b799c 100644
--- a/quic/core/quic_stream_send_buffer.h
+++ b/quic/core/quic_stream_send_buffer.h
@@ -26,7 +26,7 @@
 // contiguous memory space. Please note, BufferedSlice is constructed when
 // stream data is saved in send buffer and is removed when stream data is fully
 // acked. It is move-only.
-struct BufferedSlice {
+struct QUIC_EXPORT_PRIVATE BufferedSlice {
   BufferedSlice(QuicMemSlice mem_slice, QuicStreamOffset offset);
   BufferedSlice(BufferedSlice&& other);
   BufferedSlice& operator=(BufferedSlice&& other);
@@ -41,7 +41,7 @@
   QuicStreamOffset offset;
 };
 
-struct StreamPendingRetransmission {
+struct QUIC_EXPORT_PRIVATE StreamPendingRetransmission {
   StreamPendingRetransmission(QuicStreamOffset offset, QuicByteCount length)
       : offset(offset), length(length) {}
 
diff --git a/quic/core/quic_stream_sequencer.h b/quic/core/quic_stream_sequencer.h
index 8f8a6a0..54e0e28 100644
--- a/quic/core/quic_stream_sequencer.h
+++ b/quic/core/quic_stream_sequencer.h
@@ -25,7 +25,7 @@
 class QUIC_EXPORT_PRIVATE QuicStreamSequencer {
  public:
   // Interface that thie Sequencer uses to communicate with the Stream.
-  class StreamInterface {
+  class QUIC_EXPORT_PRIVATE StreamInterface {
    public:
     virtual ~StreamInterface() = default;
 
diff --git a/quic/core/quic_stream_sequencer_buffer.h b/quic/core/quic_stream_sequencer_buffer.h
index 93b723f..406cd92 100644
--- a/quic/core/quic_stream_sequencer_buffer.h
+++ b/quic/core/quic_stream_sequencer_buffer.h
@@ -85,7 +85,7 @@
   static const size_t kBlockSizeBytes = 8 * 1024;  // 8KB
 
   // The basic storage block used by this buffer.
-  struct BufferBlock {
+  struct QUIC_EXPORT_PRIVATE BufferBlock {
     char buffer[kBlockSizeBytes];
   };
 
diff --git a/quic/core/quic_time_wait_list_manager.h b/quic/core/quic_time_wait_list_manager.h
index e2a4594..74289ed 100644
--- a/quic/core/quic_time_wait_list_manager.h
+++ b/quic/core/quic_time_wait_list_manager.h
@@ -35,7 +35,8 @@
 // wait state.  After the connection_id expires its time wait period, a new
 // connection/session will be created if a packet is received for this
 // connection_id.
-class QuicTimeWaitListManager : public QuicBlockedWriterInterface {
+class QUIC_EXPORT_PRIVATE QuicTimeWaitListManager
+    : public QuicBlockedWriterInterface {
  public:
   // Specifies what the time wait list manager should do when processing packets
   // of a time wait connection.
@@ -49,7 +50,7 @@
     DO_NOTHING,
   };
 
-  class Visitor : public QuicSession::Visitor {
+  class QUIC_EXPORT_PRIVATE Visitor : public QuicSession::Visitor {
    public:
     // Called after the given connection is added to the time-wait list.
     virtual void OnConnectionAddedToTimeWaitList(
@@ -159,7 +160,7 @@
       QuicConnectionId connection_id) const;
 
   // Internal structure to store pending termination packets.
-  class QueuedPacket {
+  class QUIC_EXPORT_PRIVATE QueuedPacket {
    public:
     QueuedPacket(const QuicSocketAddress& self_address,
                  const QuicSocketAddress& peer_address,
@@ -229,7 +230,7 @@
   // A map from a recently closed connection_id to the number of packets
   // received after the termination of the connection bound to the
   // connection_id.
-  struct ConnectionIdData {
+  struct QUIC_EXPORT_PRIVATE ConnectionIdData {
     ConnectionIdData(int num_packets,
                      bool ietf_quic,
                      QuicTime time_added,
diff --git a/quic/core/quic_trace_visitor.h b/quic/core/quic_trace_visitor.h
index 124b4b6..29f9b03 100644
--- a/quic/core/quic_trace_visitor.h
+++ b/quic/core/quic_trace_visitor.h
@@ -14,7 +14,7 @@
 // Records a QUIC trace protocol buffer for a QuicConnection.  It's the
 // responsibility of the user of this visitor to process or store the resulting
 // trace, which can be accessed via trace().
-class QuicTraceVisitor : public QuicConnectionDebugVisitor {
+class QUIC_EXPORT_PRIVATE QuicTraceVisitor : public QuicConnectionDebugVisitor {
  public:
   explicit QuicTraceVisitor(const QuicConnection* connection);
 
diff --git a/quic/core/quic_types.h b/quic/core/quic_types.h
index afd42be..efbda04 100644
--- a/quic/core/quic_types.h
+++ b/quic/core/quic_types.h
@@ -476,7 +476,7 @@
     PacketHeaderFormat format);
 
 // Information about a newly acknowledged packet.
-struct AckedPacket {
+struct QUIC_EXPORT_PRIVATE AckedPacket {
   AckedPacket(QuicPacketNumber packet_number,
               QuicPacketLength bytes_acked,
               QuicTime receive_timestamp)
@@ -501,7 +501,7 @@
 typedef std::vector<AckedPacket> AckedPacketVector;
 
 // Information about a newly lost packet.
-struct LostPacket {
+struct QUIC_EXPORT_PRIVATE LostPacket {
   LostPacket(QuicPacketNumber packet_number, QuicPacketLength bytes_lost)
       : packet_number(packet_number), bytes_lost(bytes_lost) {}
 
@@ -542,7 +542,7 @@
 // first element of the pair is false, it means that an IETF Application Close
 // should be done instead.
 
-struct QuicErrorCodeToIetfMapping {
+struct QUIC_EXPORT_PRIVATE QuicErrorCodeToIetfMapping {
   bool is_transport_close_;
   union {
     uint64_t application_error_code_;
diff --git a/quic/core/quic_write_blocked_list.h b/quic/core/quic_write_blocked_list.h
index 7cab768..b80eca6 100644
--- a/quic/core/quic_write_blocked_list.h
+++ b/quic/core/quic_write_blocked_list.h
@@ -247,9 +247,9 @@
 
   // A StaticStreamCollection is a vector of <QuicStreamId, bool> pairs plus a
   // eagerly-computed number of blocked static streams.
-  class StaticStreamCollection {
+  class QUIC_EXPORT_PRIVATE StaticStreamCollection {
    public:
-    struct StreamIdBlockedPair {
+    struct QUIC_EXPORT_PRIVATE StreamIdBlockedPair {
       QuicStreamId id;
       bool is_blocked;
     };
diff --git a/quic/core/tls_client_handshaker.h b/quic/core/tls_client_handshaker.h
index 4672821..52afc26 100644
--- a/quic/core/tls_client_handshaker.h
+++ b/quic/core/tls_client_handshaker.h
@@ -73,7 +73,8 @@
  private:
   // ProofVerifierCallbackImpl handles the result of an asynchronous certificate
   // verification operation.
-  class ProofVerifierCallbackImpl : public ProofVerifierCallback {
+  class QUIC_EXPORT_PRIVATE ProofVerifierCallbackImpl
+      : public ProofVerifierCallback {
    public:
     explicit ProofVerifierCallbackImpl(TlsClientHandshaker* parent);
     ~ProofVerifierCallbackImpl() override;
diff --git a/quic/core/tls_server_handshaker.h b/quic/core/tls_server_handshaker.h
index 829aeaf..e7470be 100644
--- a/quic/core/tls_server_handshaker.h
+++ b/quic/core/tls_server_handshaker.h
@@ -88,7 +88,8 @@
   TlsConnection::Delegate* ConnectionDelegate() override { return this; }
 
  private:
-  class SignatureCallback : public ProofSource::SignatureCallback {
+  class QUIC_EXPORT_PRIVATE SignatureCallback
+      : public ProofSource::SignatureCallback {
    public:
     explicit SignatureCallback(TlsServerHandshaker* handshaker);
     void Run(bool ok, std::string signature) override;
diff --git a/quic/platform/api/quic_cert_utils.h b/quic/platform/api/quic_cert_utils.h
index 1c660b5..8e21fcb 100644
--- a/quic/platform/api/quic_cert_utils.h
+++ b/quic/platform/api/quic_cert_utils.h
@@ -5,12 +5,13 @@
 #ifndef QUICHE_QUIC_PLATFORM_API_QUIC_CERT_UTILS_H_
 #define QUICHE_QUIC_PLATFORM_API_QUIC_CERT_UTILS_H_
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_string_piece.h"
 #include "net/quic/platform/impl/quic_cert_utils_impl.h"
 
 namespace quic {
 
-class QuicCertUtils {
+class QUIC_EXPORT_PRIVATE QuicCertUtils {
  public:
   static bool ExtractSubjectNameFromDERCert(QuicStringPiece cert,
                                             QuicStringPiece* subject_out) {
diff --git a/quic/platform/api/quic_endian.h b/quic/platform/api/quic_endian.h
index 65edd51..56a69a9 100644
--- a/quic/platform/api/quic_endian.h
+++ b/quic/platform/api/quic_endian.h
@@ -5,6 +5,7 @@
 #ifndef QUICHE_QUIC_PLATFORM_API_QUIC_ENDIAN_H_
 #define QUICHE_QUIC_PLATFORM_API_QUIC_ENDIAN_H_
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/quic/platform/impl/quic_endian_impl.h"
 
 namespace quic {
@@ -17,7 +18,7 @@
 // Provide utility functions that convert from/to network order (big endian)
 // to/from host order (can be either little or big endian depending on the
 // platform).
-class QuicEndian {
+class QUIC_EXPORT_PRIVATE QuicEndian {
  public:
   // Convert |x| from host order (can be either little or big endian depending
   // on the platform) to network order (big endian).
diff --git a/quic/platform/api/quic_reference_counted.h b/quic/platform/api/quic_reference_counted.h
index 6ffc237..40f92d5 100644
--- a/quic/platform/api/quic_reference_counted.h
+++ b/quic/platform/api/quic_reference_counted.h
@@ -51,7 +51,7 @@
 // QuicReferenceCountedPointer<T> r_ptr_b = std::move(r_ptr_a);
 
 template <class T>
-class QuicReferenceCountedPointer {
+class QUIC_EXPORT_PRIVATE QuicReferenceCountedPointer {
  public:
   QuicReferenceCountedPointer() = default;
 
diff --git a/quic/platform/api/quic_test_mem_slice_vector.h b/quic/platform/api/quic_test_mem_slice_vector.h
index 06be8f7..ed416b7 100644
--- a/quic/platform/api/quic_test_mem_slice_vector.h
+++ b/quic/platform/api/quic_test_mem_slice_vector.h
@@ -18,7 +18,7 @@
 // Tests using QuicTestMemSliceVector need to make sure the actual data buffers
 // outlive QuicTestMemSliceVector, and QuicTestMemSliceVector outlive the
 // returned QuicMemSliceSpan.
-class QuicTestMemSliceVector {
+class QUIC_EXPORT_PRIVATE QuicTestMemSliceVector {
  public:
   explicit QuicTestMemSliceVector(std::vector<std::pair<char*, size_t>> buffers)
       : impl_(std::move(buffers)) {}
diff --git a/quic/platform/api/quic_text_utils.h b/quic/platform/api/quic_text_utils.h
index 1fa3c72..186368f 100644
--- a/quic/platform/api/quic_text_utils.h
+++ b/quic/platform/api/quic_text_utils.h
@@ -7,13 +7,14 @@
 
 #include <string>
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_string_piece.h"
 #include "net/quic/platform/impl/quic_text_utils_impl.h"
 
 namespace quic {
 
 // Various utilities for manipulating text.
-class QuicTextUtils {
+class QUIC_EXPORT_PRIVATE QuicTextUtils {
  public:
   // Returns true if |data| starts with |prefix|, case sensitively.
   static bool StartsWith(QuicStringPiece data, QuicStringPiece prefix) {
diff --git a/quic/platform/api/quic_thread.h b/quic/platform/api/quic_thread.h
index 7032dc4..4b1e564 100644
--- a/quic/platform/api/quic_thread.h
+++ b/quic/platform/api/quic_thread.h
@@ -7,12 +7,13 @@
 
 #include <string>
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
 #include "net/quic/platform/impl/quic_thread_impl.h"
 
 namespace quic {
 
 // A class representing a thread of execution in QUIC.
-class QuicThread : public QuicThreadImpl {
+class QUIC_EXPORT_PRIVATE QuicThread : public QuicThreadImpl {
  public:
   QuicThread(const std::string& string) : QuicThreadImpl(string) {}
   QuicThread(const QuicThread&) = delete;
diff --git a/quic/quic_transport/quic_transport_client_session.h b/quic/quic_transport/quic_transport_client_session.h
index 8c90aae..a39f112 100644
--- a/quic/quic_transport/quic_transport_client_session.h
+++ b/quic/quic_transport/quic_transport_client_session.h
@@ -26,7 +26,7 @@
 namespace quic {
 
 // A client session for the QuicTransport protocol.
-class QUIC_EXPORT QuicTransportClientSession
+class QUIC_EXPORT_PRIVATE QuicTransportClientSession
     : public QuicSession,
       public QuicTransportSessionInterface {
  public:
@@ -65,7 +65,7 @@
   void OnCryptoHandshakeEvent(CryptoHandshakeEvent event) override;
 
  protected:
-  class ClientIndication : public QuicStream {
+  class QUIC_EXPORT_PRIVATE ClientIndication : public QuicStream {
    public:
     using QuicStream::QuicStream;
 
diff --git a/quic/quic_transport/quic_transport_protocol.h b/quic/quic_transport/quic_transport_protocol.h
index 307354f..47ed877 100644
--- a/quic/quic_transport/quic_transport_protocol.h
+++ b/quic/quic_transport/quic_transport_protocol.h
@@ -12,17 +12,17 @@
 namespace quic {
 
 // The ALPN used by QuicTransport.
-QUIC_EXPORT inline const char* QuicTransportAlpn() {
+QUIC_EXPORT_PRIVATE inline const char* QuicTransportAlpn() {
   return "wq-vvv-01";
 }
 
 // The stream ID on which the client indication is sent.
-QUIC_EXPORT constexpr QuicStreamId ClientIndicationStream() {
+QUIC_EXPORT_PRIVATE constexpr QuicStreamId ClientIndicationStream() {
   return 2;
 }
 
 // The maximum allowed size of the client indication.
-QUIC_EXPORT constexpr QuicByteCount ClientIndicationMaxSize() {
+QUIC_EXPORT_PRIVATE constexpr QuicByteCount ClientIndicationMaxSize() {
   return 65536;
 }
 
diff --git a/quic/quic_transport/quic_transport_server_session.h b/quic/quic_transport/quic_transport_server_session.h
index 7183ead..b1a9043 100644
--- a/quic/quic_transport/quic_transport_server_session.h
+++ b/quic/quic_transport/quic_transport_server_session.h
@@ -16,11 +16,11 @@
 namespace quic {
 
 // A server session for the QuicTransport protocol.
-class QUIC_EXPORT QuicTransportServerSession
+class QUIC_EXPORT_PRIVATE QuicTransportServerSession
     : public QuicSession,
       public QuicTransportSessionInterface {
  public:
-  class ServerVisitor {
+  class QUIC_EXPORT_PRIVATE ServerVisitor {
    public:
     virtual ~ServerVisitor() {}
 
@@ -59,7 +59,7 @@
   }
 
  protected:
-  class ClientIndication : public QuicStream {
+  class QUIC_EXPORT_PRIVATE ClientIndication : public QuicStream {
    public:
     explicit ClientIndication(QuicTransportServerSession* session);
     void OnDataAvailable() override;
@@ -70,7 +70,7 @@
   };
 
   // Utility class for parsing the client indication.
-  class ClientIndicationParser {
+  class QUIC_EXPORT_PRIVATE ClientIndicationParser {
    public:
     ClientIndicationParser(QuicTransportServerSession* session,
                            QuicStringPiece indication)
diff --git a/quic/quic_transport/quic_transport_session_interface.h b/quic/quic_transport/quic_transport_session_interface.h
index 971fa5b..cdb3e99 100644
--- a/quic/quic_transport/quic_transport_session_interface.h
+++ b/quic/quic_transport/quic_transport_session_interface.h
@@ -5,11 +5,13 @@
 #ifndef QUICHE_QUIC_QUIC_TRANSPORT_QUIC_TRANSPORT_SESSION_INTERFACE_H_
 #define QUICHE_QUIC_QUIC_TRANSPORT_QUIC_TRANSPORT_SESSION_INTERFACE_H_
 
+#include "net/third_party/quiche/src/quic/platform/api/quic_export.h"
+
 namespace quic {
 
 // Shared interface between QuicTransportClientSession and
 // QuicTransportServerSession.
-class QuicTransportSessionInterface {
+class QUIC_EXPORT_PRIVATE QuicTransportSessionInterface {
  public:
   virtual ~QuicTransportSessionInterface() {}
 
diff --git a/quic/quic_transport/quic_transport_stream.h b/quic/quic_transport/quic_transport_stream.h
index 3b94eab..44694db 100644
--- a/quic/quic_transport/quic_transport_stream.h
+++ b/quic/quic_transport/quic_transport_stream.h
@@ -19,9 +19,9 @@
 // QuicTransportStream is an extension of QuicStream that provides I/O interface
 // that is safe to use in the QuicTransport context.  The interface ensures no
 // application data is processed before the client indication is processed.
-class QUIC_EXPORT QuicTransportStream : public QuicStream {
+class QUIC_EXPORT_PRIVATE QuicTransportStream : public QuicStream {
  public:
-  class Visitor {
+  class QUIC_EXPORT_PRIVATE Visitor {
    public:
     virtual ~Visitor() {}
     virtual void OnCanRead() = 0;