Kill Switch in a VPN: How It Blocks Leaks When the Tunnel Drops

A kill switch is a rule set that allows traffic only through the VPN tunnel; when the tunnel is missing, outbound traffic is dropped instead of taking the ordinary line. Your real public IP and DNS lookups stay inside. You see it as a stall: pages stop loading, apps report no network, everything resumes once the VPN reconnects.

The seconds right after a tunnel drops

Tunnels break for mundane reasons: weak Wi-Fi, a hop to mobile data, waking from sleep. Without a switch, the operating system silently routes traffic over the normal connection, and open programs such as a torrent client reconnect within seconds with your real IP. With a switch, traffic simply stops until the tunnel is back. The sturdy version lives in the OS firewall, whose rules permit only the VPN interface and the server's address, so the block holds even if the app crashes. The weaker version is a watcher inside the app that reacts after detecting a drop, and a crash takes it down too.

Whole-device blocking versus a list of apps

A system-level switch blocks every app and system service while the tunnel is down, so nothing is left outside the rules. An app-level switch cuts off only the programs you listed, while everything else keeps working over the open line; some apps ship with that toggle off by default.

Blocking even when the VPN is off

Standard mode reacts only to an unexpected drop; a manual disconnect lifts the block. Persistent mode (called "advanced" or "strict" depending on the app) allows traffic only while the VPN is connected: after a manual disconnect, after closing the app, after a restart, nothing goes online. The price: no internet until you connect or turn the mode off, and local devices such as printers and NAS may become unreachable. On some platforms, switching servers also leaves a brief moment when traffic can go out directly.

Phones: what Android and iOS let a VPN app do

Android: Always-on VPN and the blocking toggle

Since Android 7.0 the system can start the chosen VPN app at boot and keep it running. Next to the Always-on switch in Settings sits "Block connections without VPN", which drops any traffic outside the tunnel. Many Android VPN apps rely on these system switches for their kill switch, and the app's own toggle often just opens that settings screen. Known gap: a 2022 audit of Mullvad's app (finding MUL22-03) showed that Android sends its connectivity checks outside the tunnel on every Wi-Fi join, even with blocking enabled; no app can stop it, and stock Android offers no setting to turn the checks off (GrapheneOS has one). Details are in the Android developer documentation.

iPhone and iPad: limited by design

Apple's own Always On VPN exists only on supervised devices under mobile device management, so on a personal device you depend on the includeAllNetworks flag, with its system exceptions and the Apple-service DNS caveat noted in the table. In 2020 Proton VPN's researchers reported that iOS 13.3.1 and 13.4 did not close connections already open when the VPN started, so long-lived ones such as Apple push notifications could stay outside the tunnel for minutes or hours; in 2022 they reported that some DNS queries from Apple services still go out directly and that iOS 16 had not fixed it. Their workaround: connect the VPN, then turn airplane mode on and off so connections rebuild inside the tunnel, with no guarantee. A strict setup can also break AirDrop, CarPlay and Personal Hotspot. Read the Proton VPN disclosure for the updates.

Testing your own kill switch

1. Start a continuous ping to a public address in a terminal, or a page that displays your IP.
2. Break the tunnel several ways: toggle airplane mode, force-close the VPN app, switch servers.
3. Ping timeouts during the gap mean the switch works; a reply with your real address means a leak.
4. For deeper proof, watch the device from the router with tcpdump or Wireshark: with the tunnel down there should be nothing except packets to the VPN server.
5. Repeat after every app and OS update, on each device separately.

How common the feature is

In the VPNRadarLab catalogue of 543 consumer VPNs, 193 providers say they offer a kill switch, 59 say they do not, and 291 do not mention it at all (which means the provider publishes nothing about it, not that the feature is missing). The ranking page lists the 193.

FAQ

Why do I have no internet after turning the VPN off?

Persistent mode is still active: it blocks everything until a tunnel exists. Reconnect, or switch that mode off.

Does a kill switch work if the VPN app crashes?

If it is enforced by firewall rules, yes. If the app watches the connection itself, a crash can take the protection down with it.

Does it slow down my connection?

No. It acts only when the tunnel is missing.

Kill switch in short

A kill switch lets traffic flow only through the VPN tunnel and drops everything else when the tunnel is gone, protecting your real IP and DNS queries. Use system-level blocking as the default, enable persistent mode on machines that must never touch the network bare, and verify the setup with a forced drop rather than trusting the toggle.