What a VPN kill switch blocks, and how to test that yours does

What a kill switch blocks, and when it stops

Proton, which sells a VPN, describes its kill switch as blocking all internet traffic on your device if your VPN connection drops. The name covers more than one behaviour, and each seller’s help page speaks only for its own product. For the wider picture, start with the VPN guide.

Mullvad VPN AB, which sells a VPN, says the kill switch in its desktop app is always on and cannot be turned off in the settings. It says it continues to block your traffic until a secure connection is made or reestablished, or until you manually disconnect from the app, and it offers an optional Lockdown mode that also blocks after you click Disconnect or Quit.

Proton’s standard kill switch, in its own words, “is only activated when your connection drops by accident”. Proton says its advanced kill switch, available on Windows, the Linux GUI app, and iOS and iPadOS (beta), only allows internet access when connected to Proton VPN, with no exceptions.

Surfshark, which sells a VPN, gives its app two modes. Its soft kill switch acts when the VPN connection drops unexpectedly. Its strict kill switch, Surfshark says, blocks internet access any time the VPN is off, even if you disconnected manually.

Why Disconnect tells you little about an accidental drop

Pressing Disconnect is a deliberate act, and Proton and Surfshark say the lower level of their kill switch acts only when the connection drops by accident or unexpectedly. So if you press Disconnect and the internet keeps working, that fits what the lower level is documented to do. It tells you nothing about whether the block would hold if the connection failed by itself.

Avast, which sells a VPN and antivirus products, advises: “Disconnect your VPN by force-closing the app instead of toggling the connection off to confirm that traffic stops as expected, then reconnect”. It gives this as general advice.

On a Windows VPN profile configured as LockDown, Microsoft says the user can’t disconnect the VPN connection, so the Disconnect test does not apply there. To switch a VPN off on purpose, see turning a VPN off on Windows, Mac, iPhone and Android.

How to test yours

The sequence below is ours, not a vendor’s or a system’s. The sources say what a block does and what you should see when it works, and each step names where its signal comes from. The order of the steps and the choice to cause a failure are this site’s own, and nothing in it is timed. It does not apply to Linux or OpenVPN, covered further down.

1. Find out which kind of kill switch you have. Look in the app’s settings for the kill switch and its mode, and note whether it blocks after a manual disconnect.
2. Know what the app is meant to show. Mullvad says that when its desktop kill switch is blocking, the padlock in the system tray or menu bar turns green with a red dot and the connection screen shows BLOCKING INTERNET. Android’s developer documentation says that from Android 8.0 people see a non-dismissible notification when an always-on VPN connection disconnects or can’t connect. For any other app, the sources describe no signal.
3. Make the connection fail without using Disconnect. Avast, which sells a VPN, suggests force-closing the app, and none of the other sources cited on this page describes that step. It is a failure the app does not choose. On a Windows LockDown profile this step does not apply.
4. See whether traffic stops. Try a page or an app that needs the internet. Avast admits that in rare cases there may be a slight delay before traffic is blocked. The sources do not give a length for that delay, and this page does not guess one.
5. Reconnect and check that normal use returns.

What Windows, Mac, iPhone and Android offer, and what has to be switched on

Android. Google’s Android Developers documentation, last updated on 26 February 2026, says an always-on VPN is available from Android 7.0 (API level 24) and can also block connections that do not use the VPN, through the Block connections without VPN switch in Settings. Google Help, whose page says some of its steps only work on Android 14 and up, says that if you have set up a VPN through an app, you won’t have the always-on option, while Proton, which sells a VPN, tells Android users to use Android’s own settings for its kill switch. The sources do not reconcile these two statements, and this page does not settle them.

iPhone, iPad and Mac. Apple’s developer documentation says that a VPN app that sets includeAllNetworks makes the system drop network traffic when the VPN transitions away from the connected state. That applies only to apps that set the property, and Apple also says the system excludes network control traffic that maintains the device’s connection to the local network, such as DHCP. For an always-on VPN profile on an iOS device supervised with MDM (mobile device management), Apple says the system drops network traffic when the VPN isn’t connected, a profile an organisation applies.

Windows. Microsoft’s documentation, updated on 28 January 2025, describes a VPN profile configured with LockDown: if the VPN connection isn’t available, outbound network traffic is blocked, and the user can’t disconnect. For the built-in Windows VPN, LockDown is only available for the IKEv2 connection type. Microsoft’s page does not call this a kill switch. Windows also has a feature called Always On, which Microsoft describes as connecting the active VPN profile automatically on user sign-in, network change and device screen on; that page does not describe it as blocking traffic.

What can still get out

What the sellers admit. Mullvad says that on macOS its app can’t ensure it starts before other applications start sending traffic, so traffic may leak during system startup. Proton, for its macOS app, says some DNS requests from Apple services can bypass the VPN even with the kill switch enabled. It also says that on macOS, when switching servers, there is a brief period where your real IP address may be exposed.

Android in 2022. Mullvad published a blog post on 10 October 2022 that its page now marks as 4 years old and possibly out of date. In it, Mullvad reported that Android sends connectivity checks outside the VPN tunnel every time the device connects to a WiFi network, even when Block connections without VPN is on. This page has not checked that on a current Android. For encrypted DNS there, see private DNS on Android.

TunnelVision. Leviathan Security Group, a security firm, describes a technique, tracked as CVE-2024-3661, that uses DHCP option 121 to push routes so that traffic leaves over the network interface talking to the DHCP server instead of the VPN’s virtual interface. It says the affected systems have a DHCP client that supports option 121, which includes Windows, Linux, iOS and macOS, and not Android. On kill switches, Leviathan writes: “Importantly, the VPN control channel is maintained so features such as kill switches are never tripped, and users continue to show as connected to a VPN in all the cases we’ve observed.” Leviathan speaks about the cases it observed, not about every product.

IPv6, in 2015. A study by Perta and colleagues found that the majority of 14 commercial VPN services suffered from IPv6 traffic leakage. It does not examine kill switches.

Linux and OpenVPN: what the manuals say

This section reports what two manuals say; the sources read for this page describe no way to test either setup.

WireGuard on Linux. The wg-quick(8) manual page, as copied on man7.org and dated 1 January 2016, introduces its kill switch as something one might attempt: its own word is “attempt”. The rule is an iptables rule added with PostUp, which rejects output that is not leaving through the tunnel interface or carrying the WireGuard mark, and PreDown removes it. It is for interfaces with a peer that specifies 0.0.0.0/0 as part of AllowedIPs.

The manual states a limit itself: the rule continues to allow most DHCP traffic through, since most DHCP clients use PF_PACKET sockets, which bypass Netfilter.

OpenVPN. The OpenVPN 2.6 reference manual contains no mention of a kill switch. It does have options that block one kind of traffic each, such as --block-ipv6 and --block-outside-dns, which blocks DNS servers on other network adapters to prevent DNS leaks; the manual says it uses the Windows Filtering Platform and works on Windows Vista or later. The manual does not call any of them a kill switch.