VPN Kill Switch: What It Does, How to Turn It On, How to Test It

A VPN kill switch blocks your internet traffic whenever your VPN connection drops, so your real IP address and unencrypted traffic don’t slip out while the tunnel is down. Turn it on in your VPN app’s settings (on Android, also enable Always-on VPN and Block connections without VPN), then test it, because kill switches have known gaps on some platforms.

Below: how the feature works, the two modes you’ll see in most apps, how to enable it on each platform, and what it won’t protect you from. Menu names and platform support below are as of October 2026 and change between app versions.

How a VPN kill switch works

When your VPN is connected, all traffic is supposed to go through the encrypted tunnel. Connections drop for ordinary reasons: switching Wi-Fi networks, a laptop waking from sleep, a server going offline. Without a kill switch, your device quietly falls back to your normal connection, and apps keep sending traffic from your real IP address.

A kill switch stops that fallback. It blocks traffic outside the VPN until the tunnel is back up, then restores access. Good implementations do this with firewall rules that only allow traffic through the VPN interface, rather than by watching the connection and reacting after the fact, since a reactive approach leaves a short window between the drop and the block.

Standard vs. always-on (advanced) kill switch

Most apps now offer two levels:

Proton VPN explains that its standard kill switch only engages once a VPN connection has started and turns off when you disconnect manually or shut down. Its Advanced kill switch, on Windows and Linux, blocks traffic outside the VPN even when the VPN is off.

Other providers do the same thing under different names. ExpressVPN’s Network Lock is its kill switch. ExpressVPN says it is on by default in its Windows, Mac, Linux and router apps, and its support pages describe an extra “Enable at all times” option on Mac and Linux. In the Mullvad app, the basic kill switch can’t be switched off, and a separate Lockdown mode blocks all traffic while the VPN is disconnected, according to the app’s CLI reference. Older Mullvad versions called this “Always require VPN”.

Which should you use? The standard mode suits most people. Use the always-on mode if a leak of even a few seconds would matter to you, for example at startup before the VPN app connects. Just remember that with it on, you’ll have no internet whenever the VPN is off, which is the point.

How to turn on a VPN kill switch

Exact menus differ by app and version. These steps follow the providers’ own documentation as of this writing.

Windows and Linux (Proton VPN example)

1. Open the app and go to the kill switch control (in the quick settings bar or sidebar on Windows; Settings → Features on Linux).
2. Toggle the kill switch on.
3. On Windows, choose Standard or Advanced kill switch.
4. Click Apply or Reconnect to save it.

For other apps, look for “kill switch”, “Network Lock” or “lockdown” under settings, often in a security or connection section.

macOS

In Proton VPN, the support page puts the kill switch control on the Countries tab; set it to On. In ExpressVPN, Network Lock is on by default, and the always-on option is in the kill switch settings. Proton lists some macOS limitations: your real IP can be briefly exposed during a server switch, and some DNS requests for Apple services can bypass the VPN.

Android

Android has a system-level kill switch, and many VPN apps rely on it:

1. Open your phone’s Settings and find the VPN section (often under Network & internet; the path varies by manufacturer).
2. Tap the gear icon next to your VPN app.
3. Turn on Always-on VPN.
4. Turn on Block connections without VPN.

You need both toggles. With only Always-on VPN enabled, Android just shows a notification when the tunnel drops. Proton VPN’s in-app kill switch (Settings → Features → Kill switch) sends you to these same Android settings, and Proton says it isn’t available on Android 7.x or earlier.

iPhone and iPad

In Proton VPN, go to Settings → Security Options and enable Kill switch. Other iOS apps put it in a similar place. Proton notes that with the kill switch on, local network devices become unreachable and some Apple-service DNS requests can still bypass the VPN. Read the iOS section below before relying on it.

Known limitations

A kill switch reduces leaks, but providers and researchers have documented cases where traffic still escapes.

Android connectivity checks

Mullvad reported in 2022 that Android sends connectivity-check traffic outside the tunnel every time it connects to Wi-Fi, even with Block connections without VPN enabled. Android uses this traffic to detect captive portals (hotel and airport login pages). Mullvad found no user-facing setting to stop it and said Android’s wording overstates what the setting blocks. I couldn’t confirm whether newer Android versions changed this, so assume it may still apply.

Apple traffic on iOS

IVPN removed the kill switch from its iOS app for iOS 16 and later after researchers found that traffic to Apple’s servers still went outside the tunnel, even with Apple’s includeAllNetworks setting enabled. That is the setting iOS VPN apps use to build a kill switch. Other providers still offer an iOS kill switch, and Proton’s own documentation warns about Apple-service DNS bypassing the VPN. The practical takeaway: an iOS kill switch helps when the tunnel drops, but it can’t stop Apple’s own services from going outside it.

Local network devices

Blocking everything outside the tunnel can also block your printer, NAS or Chromecast. ExpressVPN has a separate setting to allow local network devices, which TechRadar reports is on by default. Proton says local devices are unreachable with its kill switch on macOS and iOS. If something on your home network stops working after you enable the kill switch, this is probably why.

Server switches and reboots

The gap between disconnecting from one server and connecting to the next is a common weak spot. Proton names it as a macOS limitation. If startup leaks worry you, use the always-on mode where your app has one. A standard kill switch isn’t active before the VPN connects.

How to test your kill switch

You don’t need special tools. A rough check:

1. Connect to the VPN and open an IP-checking page (your VPN provider likely has one). Note the VPN IP it shows.
2. Start something that keeps a connection open, such as a continuous ping in a terminal or a streaming video.
3. Force a drop: switch Wi-Fi networks, toggle airplane mode off and on, or switch servers in the app.
4. Watch whether traffic stops. With a working kill switch, the ping fails or the video stalls until the VPN reconnects.
5. Refresh the IP page as soon as you’re back online. It should show a VPN IP, not your own.

For the always-on mode, also disconnect the VPN manually and confirm that nothing loads, then restart the device and check that nothing gets online before the VPN connects.

Bottom line

Turn the kill switch on. It’s usually a single toggle, and on Android it’s the two system settings above. Pick the always-on mode if you want no traffic outside the VPN at all, and accept that you’ll be offline whenever the VPN is off. Test it once after setup and again after major app or OS updates, and keep the platform-level gaps on Android and iOS in mind.