Definition and purpose

A VPN kill switch is a safety feature designed to reduce “leaks” when the VPN connection fails. If the encrypted tunnel is interrupted—such as after a service crash, a network change, or a temporary loss of connectivity—the kill switch stops your device from sending traffic through the regular internet path.

The core goal is simple: if the VPN is not available, the kill switch limits connectivity rather than letting data travel unprotected by the VPN.

A simple working model

You can think of a kill switch as a guard that continuously checks whether the VPN tunnel is active. When the tunnel is healthy, normal traffic can flow through the VPN. If the tunnel becomes unavailable, the guard triggers a fail-closed behavior.

Depending on the implementation, “fail-closed” usually means one of these actions:

  • Blocking outbound connections at the firewall level.
  • Removing or disabling the network route(s) that would otherwise send traffic outside the VPN.
  • Stopping traffic on specific network interfaces so that only the VPN interface is usable.

This is why the kill switch is most effective when it is integrated with the VPN client or configured at the operating-system networking level.

What it stops, and what it may not

A kill switch is primarily about preventing traffic from bypassing the VPN tunnel during a failure. However, it does not magically protect every possible scenario in every configuration.

Key limitations to keep in mind:

  • Timing matters: if traffic is sent in the brief period before the kill switch detects the tunnel loss, a small amount of traffic could pass.
  • Configuration matters: incorrect firewall rules or route settings can weaken the “block when down” behavior.
  • Scope varies: some setups may still allow certain local network access (for example, to printers or a router) while blocking internet-bound traffic.
  • Application behavior matters: if an app uses uncommon network paths or protocols, it may not always be covered by the same controls.

So, while the intent is to stop traffic during tunnel loss, the real-world coverage depends on the detection speed and how the rules are applied.

Differences between kill switch modes

Kill switches are often described in terms of how strictly they enforce isolation.

Common distinctions include:

  • Strict mode: blocks general outbound traffic whenever the VPN tunnel is down.
  • Split or partial policies: may allow specific destinations while still reducing leak risk.
  • Interface-based controls: treat certain network interfaces as allowed/blocked depending on VPN state.

When comparing behaviors, focus on the practical question: during a VPN outage, what types of traffic are blocked, and what exceptions are intentionally permitted?

If your main concern is preventing outside traffic from going through the non-VPN path, the most relevant factor is whether the kill switch is fail-closed for internet-bound traffic.

Practical checks you can do

To verify how a kill switch behaves on your device, test with controlled failure scenarios rather than relying on assumptions.

Practical checks:

  • Start the VPN, confirm connectivity, then abruptly disable the VPN connection and observe whether internet access is blocked.
  • Watch for differences between “VPN disconnected” and “VPN paused” states, since detection logic can differ.
  • If your setup allows local network access, confirm whether local services still work while internet access does not.

Because implementations vary and you may see different behavior across operating systems and VPN clients, treat results as configuration-specific rather than universal.