Kill Switch

A kill switch is a safety feature in VPN apps that stops internet traffic when the encrypted tunnel fails. VPN connections drop for ordinary reasons: weak Wi-Fi, switching between networks, a server restart, the device waking from sleep. Without a kill switch, the operating system quietly sends traffic over your normal connection in those moments, exposing your real IP address and unencrypted requests. With a kill switch, that traffic is blocked until the VPN is back.

How it works

Most kill switches are firewall rules, not a literal "off" button. When the feature is on, the VPN app tells the operating system to allow traffic only through the VPN's virtual network interface and to the VPN server itself. Everything else is dropped. On Windows this usually uses the Windows Filtering Platform, on macOS the packet filter, on Linux nftables or iptables.

Because the rules sit at the system level, they keep working even if the app freezes or the tunnel breaks. When the VPN reconnects, traffic flows again. Some apps remove the rules when you press disconnect yourself, because a manual disconnect is treated as intentional.

Mobile platforms differ. Android has a built-in "Always-on VPN" option with "Block connections without VPN", which works as a system-level kill switch for any VPN app. On iOS, apps rely on Apple's VPN framework, and some system services can still send traffic outside the tunnel, so protection there is less complete than on desktop.

Types of kill switch

A standard system-wide kill switch acts only after a connection has been made and then lost. A persistent mode also covers the gap before the VPN first connects, for example right after a restart.

When you need it

A kill switch matters whenever a brief leak would cause real harm. Common cases: torrenting, where a single leaked connection shows your real IP to the swarm; public or hotel Wi-Fi, where a drop sends traffic over an untrusted network; work in countries with heavy censorship or surveillance, where a leak can identify the user; and account management or geo-specific tasks, where a sudden switch to your home IP can flag an account.

For casual streaming, a drop is just an annoyance, so some users leave it off to avoid losing connectivity.

Limits and risks

• A kill switch only covers drops. It does not fix DNS, IPv6 or WebRTC leaks while the VPN is connected. Those need separate leak protection, private DNS and browser settings.
• Apps or sites excluded through split tunneling bypass the VPN, and usually the kill switch too.
• Some apps disable it by default, or offer it only on certain platforms or paid tiers.
• On iOS and some smart TVs, the feature may be missing or weaker.
• A strict kill switch can leave you offline if the VPN cannot reconnect, for example on captive portal Wi-Fi that needs a login page first. Look for an option to allow local network access or a temporary pause.
• It does not make the VPN more trustworthy. If the provider logs traffic, a kill switch will not help, so check the no-logs policy separately.

What to check when comparing VPNs

• Which platforms have it: Windows, macOS, Linux, Android, iOS, routers, TVs.
• Whether it is system-wide, app-level, or both, and whether a persistent or always-on mode exists.
• Whether it is on by default and available on free plans.
• How it behaves with split tunneling and with LAN devices like printers.
• Whether it also blocks DNS and IPv6 traffic outside the tunnel.

To test it, connect to the VPN, open an IP check page, then force a drop: end the VPN process, switch Wi-Fi networks, or change servers. Pages should stop loading until the tunnel returns, and the IP shown should never be your own. Pressing disconnect in the app is not a valid test, because many apps lift the block on a manual disconnect.

Kill switch vs split tunneling: a kill switch decides what happens when the tunnel fails, while split tunneling decides which traffic uses the tunnel in the first place.