What Is a VPN Kill Switch?

A kill switch continuously monitors your VPN connection. If it detects the encrypted tunnel has dropped — due to network instability, server issues, or switching between Wi-Fi networks — it immediately blocks all internet traffic from leaving your device until the VPN reconnects.

There are two types of kill switches:

• Application-level kill switches only block traffic for specific apps you select (e.g., your torrent client or browser)
• System-level kill switches block all internet traffic device-wide

System-level kill switches offer stronger protection but can be inconvenient if the VPN frequently disconnects. Most premium VPNs let you choose between the two modes.

VPN connections can drop for several reasons:

• Unstable Wi-Fi — Weak signals or congested networks cause intermittent packet loss
• Network switching — Moving between Wi-Fi and mobile data triggers reconnection
• Server overload — Connecting to a crowded VPN server can cause timeouts
• ISP interference — Some ISPs actively interfere with VPN protocols
• Firewall conflicts — Local security software may block VPN traffic
• Device sleep/wake — Laptops and phones may drop VPN connections during sleep mode

Even brief disconnections of 2–3 seconds can expose your real IP to websites, P2P peers, or your ISP. On mobile devices, disconnections happen more frequently because phones constantly switch between cell towers and Wi-Fi networks, making mobile kill switches especially important.

Under the hood, VPN kill switches use different mechanisms depending on the operating system:

On Windows, most VPNs modify the Windows Filtering Platform (WFP) rules or configure the built-in firewall to block all non-VPN traffic. NordVPN and ExpressVPN both use WFP-level blocking, which is more reliable than application-layer solutions.

On macOS, kill switches typically use the pf (packet filter) firewall to block traffic at the kernel level. This is critical because macOS has a known behavior of sending network traffic briefly during sleep-to-wake transitions before the VPN reconnects.

On Linux, iptables rules are commonly used to restrict traffic to the VPN interface only.

On mobile platforms, iOS uses the NEVPNProtocol "On Demand" API, while Android uses the built-in "Always-On VPN" system setting combined with the "Block connections without VPN" toggle.

NordVPN offers both app-level and system-level kill switches on all platforms, with app-level and system-level options documented in provider materials. The system-level kill switch uses WFP on Windows and pf on macOS for kernel-level protection.

ExpressVPN calls their feature Network Lock and it's enabled by default — a smart design choice since many users forget to turn it on. Provider materials describe Network Lock as a system-level traffic block when the VPN disconnects.

Surfshark includes a reliable kill switch across all apps with a clean toggle in settings. Their "Strict" mode blocks all non-VPN traffic, while "Flexible" mode allows LAN access during VPN drops.

ProtonVPN offers an Always-on VPN mode on Android that provides kill-switch functionality at the OS level, making it one of the most secure mobile implementations.

Private Internet Access provides a configurable kill switch with per-application controls. Review its current privacy disclosures and app behavior before relying on it for sensitive activity.

Do this on a device you can afford to lose connectivity for a minute (not during a work call):

1. Connect the VPN. Confirm a new IP with What Is My IP.
2. Turn the kill switch on. Names vary: Network Lock, Always-on + block without VPN, Internet kill switch.
3. Disconnect inside the app, or toggle the VPN off in the OS while a download or a streaming tab is open.
4. You want no page loads and no return of your home IP until you reconnect. If the IP page shows your ISP while the app says “protecting you,” the switch failed.
5. Optional: sleep the laptop, wake it, and reload the IP tool before the app finishes reconnecting.
6. On Android, also enable Always-on VPN and Block connections without VPN in system settings — that is stronger than many in-app toggles.

We do not publish a sitewide kill-switch scorecard. When a review has a dated first-party note, it will say pass/fail for a named OS on that review’s How-we-tested section.

Hotel captive portals often need a few seconds of raw internet so you can accept terms. Turn the kill switch off, sign in, turn it back on. Same for some bank apps that refuse VPN IPs — disconnect, finish, reconnect. Do not leave it off on airport Wi-Fi as a lifestyle choice.