What Is a VPN Kill Switch? How It Works and When It Fails 2026

Your VPN says Connected. Then you switch servers, and for two seconds it’s connected to nothing.

So, what is a VPN kill switch? It’s a firewall rule that blocks all traffic while the VPN tunnel is down, so your real IP can’t slip out. Use the system-wide one, not the per-app kind.

We tested it. In a 2-second reconnect without one, 1 in 3 requests leaked our real IP.

The catch? Most kill switches stand down at the exact moments you’d assume they’re on.

What does a kill switch do when the tunnel drops?

A VPN kill switch blocks every connection that isn’t going through the VPN tunnel. When the tunnel drops, nothing leaves your device until it’s back.

Your computer doesn’t know it should wait. When the tunnel disappears, it sends traffic out the next route it has: your Wi-Fi, in plain view of whoever runs it.

Good kill switches don’t wait for trouble. They load firewall rules when you click Connect: block everything, then allow two exceptions. Traffic inside the tunnel, and encrypted packets to the VPN server.

Mullvad’s security docs call this failing closed: if a packet can’t leave encrypted, it can’t leave.

So the name is misleading. It isn’t a red button that fires when something breaks. It’s a wall that’s already standing.

A VPN without one protects you only while nothing goes wrong. That’s why it sits on our checklist for whether a paid VPN is worth it.

We pulled the plug on a WireGuard tunnel. Here’s what leaked

Without a kill switch, our test laptop sent its next request over plain Wi-Fi, real IP and all. With one, the request never left.

Our Linux test box ran three isolated network namespaces: a laptop, a Wi-Fi router with a test website, and a WireGuard server. tcpdump on the router logged what the Wi-Fi could see.

One honest note: we didn’t test a commercial VPN app. We wrote the same kind of firewall kill switch the big apps describe in their docs, then broke the tunnel five ways.

Row two is the leak everyone fears. The router’s capture showed the request word for word: the site we asked for and the tool that asked.

Row four surprised us. When the server went silent, WireGuard kept the tunnel up, so traffic went into a pipe that led nowhere. No leak, even without a kill switch.

Leaks happen when the tunnel itself is torn down, which is what an app crash does, and what many apps do when you switch servers.

So we timed a server switch. A script asked the website for our IP every 200 ms while the tunnel vanished for 2 seconds. Without a kill switch, 10 of 30 answers showed our real address. With it, those 10 requests failed instead.

System-wide or per-app: which kill switch should you turn on?

The system-wide one. It blocks all traffic when the tunnel is down, while a per-app kill switch only stops the apps you remembered to list.

Per-app still earns a place as a second layer. NordVPN’s Windows app can close a chosen program, say a torrent client, the moment the VPN drops. It ships switched off.

Our take: system-wide always, per-app on top for the one program you’d hate to see leak. Lockdown is for people who never want to be online outside the VPN.

Here’s what three big names call each one. We earn a commission if you buy through these links; it doesn’t change what we recommend.

• NordVPN splits it into an Internet Kill Switch and an App Kill Switch on Windows. On the Mac App Store version and iOS it’s called VPN bypass prevention.
• ExpressVPN calls it the Internet Kill Switch, on by default. Its Enable at all times option turns it into lockdown on Windows, Mac and Linux.
• Surfshark keeps it under Settings, VPN settings. On Windows, Soft mode blocks after a surprise drop and Strict mode blocks whenever the VPN is off.

Read one line in ExpressVPN’s docs twice. While the app is still connecting, its kill switch can take a few seconds to kick in. Our ExpressVPN review covers how its apps behave day to day.

Where is the kill switch on your phone or laptop?

On a laptop it lives inside your VPN app’s settings. On Android the strongest version sits in the phone’s own settings, and on iPhone it depends on Apple.

• Android 7.0 and later: Settings, Network & internet, VPN, then the gear next to your VPN. Turn on Always-on VPN and Block connections without VPN. Samsung puts VPN under Connections, More connection settings.
• iPhone and iPad: no system toggle. The app relies on an Apple option that forces traffic into the tunnel, and Apple lets some of its own services skip it.
• Windows and macOS: in the app’s settings. On Windows it builds rules in the same filtering layer Windows Firewall uses. Mac App Store versions follow Apple’s tunnel rules instead.
• Linux: one command, such as nordvpn set killswitch on or expressvpnctl set networklock true, or rules you write yourself.

The Android toggle beats any in-app switch, because the phone enforces it, not the app. No app can flip it for you.

Two exceptions survive. Google confirms Android’s connectivity checks go outside the VPN by design, and some system traffic, like tethering, can bypass it.

iPhones are the weak spot. IVPN pulled its iOS kill switch for iOS 16 and later after finding traffic to Apple’s servers still leaving outside the tunnel. On an iPhone, treat any kill switch as best effort.

Covering a family’s phones on one plan? Start with our Surfshark VPN review.

Five moments a kill switch won’t cover

A kill switch guards the time the VPN is supposed to be connected. Before it starts and after you stop it, most stand down.

1. Right after you switch on your computer

Your VPN app starts like any other program, and other programs can get online first. Mullvad documents this early-boot leak on macOS and says it has no fix to ship.

The fix is boring but works: switch Wi-Fi off before shutting down, and open nothing sensitive until the VPN says Connected.

2. When you click Disconnect

ExpressVPN’s support page says its kill switch doesn’t block traffic once you disconnect yourself. WireGuard’s sample Linux kill switch deletes its own rule when you take the tunnel down.

That’s by design. To keep the wall up after you disconnect, you need a lockdown mode like the ones above.

3. Apps you excluded with split tunnelling

Split tunnelling routes chosen apps around the VPN on purpose, so they stay online when the tunnel drops. Mullvad even lets excluded apps online in lockdown.

Android goes the other way. With lockdown on, apps you excluded lose internet completely.

4. IPv6 and DNS that the rules forgot

Look at the last row of our table. A kill switch written for IPv4 alone blocked the IPv4 request and waved the IPv6 one through, carrying our real address.

If your network hands out both kinds of address, the rules must cover both. DNS is the same: lookups that reach your router reveal which sites you visit.

5. Leaks while the VPN still says Connected

A kill switch asks one question: is the tunnel up? Leaks that happen while it’s up never trip it.

The best-known case is TunnelVision, disclosed in 2024. A rogue Wi-Fi router pushes extra routes that steer traffic around a connected VPN. Firewall-style kill switches block that traffic, and ExpressVPN says its own did. Apps that rely on routing alone leak.

WebRTC leaks are a browser issue. Fix them in the browser, not the VPN.

Want to read one? Here are the rules we tested

A kill switch fits in four rules. This is the nftables file behind row three of our table, the one that blocked IPv4, IPv6 and DNS.

# sudo nft -f killswitch.nft
table inet killswitch {
  chain out {
    type filter hook output priority 0; policy drop;
    oifname "lo" accept                       # this machine talking to itself
    oifname "wg0" accept                      # anything inside the tunnel
    ip daddr 10.1.0.2 udp dport 51820 accept  # the VPN server (use yours)
    reject                                    # everything else fails fast
  }
}

Three details do the work. table inet covers IPv4 and IPv6 at once, which closed our IPv6 leak. The server exception lets the tunnel rebuild itself. The reject line makes blocked apps fail fast instead of hanging.

Expect one side effect: these rules also block your printer and router page. Add an exception for your home network range if you need them.

Warning: never load rules like these over SSH on a remote server. The first thing they block is the connection you’d use to undo them.

How to test your kill switch in five minutes

Force a drop while something is online, then see whether your real IP ever shows. Our guide to proxy leak checks covers IP, DNS and WebRTC tests in depth.

Pings still flowing with the app closed? That kill switch only works on paper.

Do you need a kill switch? Our take by situation

If you use a VPN for privacy, yes. If you use it only to watch another country’s catalogue, it’s optional.

• Public Wi-Fi and remote work: system-wide, always on. A dropped tunnel in a cafe is row two of our table. Our pick of VPNs for remote work covers which apps hold up on calls.
• Torrenting: system-wide plus a per-app kill switch on the client. A client that keeps seeding during a drop shows your real IP to the whole swarm.
• Streaming only: optional. A drop pauses the stream either way; the kill switch stops it reloading outside the VPN.
• High-risk work like reporting: lockdown mode on a laptop or Android phone and Wi-Fi off at shutdown. Don’t count on an iPhone.

Want a provider whose kill switch works on every device you own? Our NordVPN review goes through its apps one platform at a time.

Frequently asked questions

The bottom line

A VPN kill switch is a firewall that fails closed. Switch on the system-wide version on every laptop and Block connections without VPN on Android.

Torrent? Add a per-app kill switch for the client. Need the wall up around the clock? That’s lockdown mode.

Just remember where it stands down: at boot, after you disconnect, and for split-tunnelled apps.

Then run the five-minute ping test tonight. It’s the only way to know yours works.