A VPN kill switch is a feature that blocks your device's internet access whenever the VPN tunnel is down, until the tunnel is back. Without it, the moment the connection drops, your phone or laptop keeps working on the ordinary connection: sites still load, apps keep syncing, and you do not notice that the VPN is gone and everything is going out with your real IP address through your ISP. The name is literal. It does nothing while the VPN works; its whole job is the few seconds or minutes when the VPN has failed and you do not know yet.

What happens without one

VPN tunnels drop more often than people think. Your phone moves from Wi-Fi to mobile data, your laptop wakes from sleep, the router reboots, the server goes down for maintenance, the app updates. Each time, the system is without a tunnel for a moment.

Operating systems are built to keep the internet working, so the instant the tunnel disappears, they route traffic the normal way. Open tabs, background sync, messaging apps, cloud backups all continue, now with your real address and your ISP's DNS. To a site you were logged into, it looks like the same user who was in Amsterdam a second ago is now in Ohio.

Two kinds of kill switch

App level. The VPN app watches the tunnel. When it drops, the app adds a firewall rule ("allow nothing except the VPN server") or disables the network interfaces. Works everywhere; fails if the app itself crashes or is closed.

System level. The operating system enforces "all traffic goes through the VPN interface" regardless of the app. On Android this is the "Block connections without VPN" setting; on iOS it is available to managed profiles; on Windows and macOS the app installs firewall rules at setup time. This survives an app crash.

Good apps use both: the app manages the tunnel, the system rule catches the case where the app stops responding.

When it triggers

  • Switching networks: café Wi-Fi to mobile data to home Wi-Fi.
  • Waking a laptop, where the network comes up before the VPN reconnects.
  • Switching servers inside the app: the old tunnel is closed, the new one not yet up.
  • Server maintenance or overload.
  • Flaky connections on trains and planes.

In all of these, the kill switch keeps the internet closed until the tunnel is back. It looks like "the internet dropped for five seconds," which is exactly right.

Android: two switches, not one

Android has two related settings, and people confuse them. "Always-on VPN" makes the system reconnect the VPN automatically after any drop. "Block connections without VPN" is the actual kill switch: until the tunnel is up, no app gets online. The first without the second protects nothing, because traffic goes out during the gap. Turn on both: Settings → Network & internet → VPN → gear icon next to the app. iPhone has no built-in switch for ordinary apps, so on iOS the feature has to be in the app itself; see what is VPN on iPhone settings.

How to test it

  1. Connect the VPN and open What Is My IP. Note the address; that is the server.
  2. Make sure the kill switch is on in the app. Some ship with it off.
  3. Break the tunnel on purpose. The cleanest way is to switch servers in the app and reload the page during the switch. Another is to block the VPN server's address on your router or firewall for a minute so the tunnel dies by itself.
  4. While the VPN is reconnecting, pages should not load at all. If the page reloads and shows your real address, the kill switch is off or not working.
  5. After reconnection, check the address again and run the WebRTC leak test: a browser can reveal your real address through WebRTC even with the tunnel up, and that is a separate problem.

When it gets in the way

  • Local devices. A strict kill switch can block the printer, NAS or TV casting on your home network. Look for an "allow local network" option.
  • Unstable networks. On a train the internet already drops every few minutes; with the kill switch it drops slightly longer while the tunnel reconnects. Not a bug.
  • Apps that refuse to work through a VPN. Do not turn the kill switch off for them; put them in split tunneling instead, explained in what is split tunneling.
  • Captive portals. The café's login page cannot load while everything is blocked. Turn the VPN off for a minute, log in to the Wi-Fi, turn it back on.

Checklist

  • Kill switch on in the app.
  • On Android, also "Block connections without VPN" in system settings.
  • Tested once with the steps above.
  • Local network exception on if you use a printer or NAS.
  • If drops are frequent, fix the cause with why does my VPN keep disconnecting.

404 VPN's kill switch is on by default: when the tunnel drops, traffic is blocked rather than switched to the open connection. The rest of the protection is described on the security page; get started here.