Kill Switch
Automatically cuts traffic if the VPN drops, preventing data leaks.
How It Works
The VPN client monitors the tunnel state by checking keepalive packets and interface status. If the tunnel drops unexpectedly, the client activates OS-level firewall rules (iptables/nftables on Linux, Windows Filtering Platform on Windows, pf on macOS) that block all traffic except traffic destined for the VPN server. Only when the tunnel is re-established are the restrictive rules removed, ensuring no data travels over the unencrypted connection.
Advantages
- Prevents IP address exposure during brief VPN disconnections that users may not notice
- Protects applications that do not handle network interruptions gracefully (torrent clients, streaming apps)
- Operates automatically without requiring user intervention when the VPN drops
- Network-level protection applies to all applications simultaneously, unlike application-level timeouts
Disadvantages
- Can cause complete internet outage if the VPN is unstable, making troubleshooting difficult
- Some implementations do not protect against IPv6 traffic leakage — requires separate IPv6 kill switch
- May interfere with split-tunneling configurations if both features share the same firewall rules
- Persistent kill switch rules can survive VPN client crashes or improper shutdowns, leaving the device offline until manually reset
Security Impact
Critical — the kill switch is the last line of defense against IP leaks. Without it, a VPN disconnection of even a few milliseconds can expose the user's real IP address to visited websites or P2P peers.
Performance Impact
None when the VPN connection is stable. During reconnection events, internet access is blocked for the duration of the tunnel re-establishment, typically 1-5 seconds.
Ideal For
Providers with Kill Switch(8)
CyberGhost
Romania-based VPN with 11,690+ servers in 100 countries, dedicated streaming profiles, and strong privacy protections outside 14 Eyes.
ExpressVPN
Premium VPN with TrustedServer RAM-only infrastructure, custom Lightway protocol built in Rust, and 105 country locations.
Mullvad
Privacy-first VPN with RAM-only servers, anonymous signup, post-quantum encryption by default, and WireGuard-only infrastructure.
NordVPN
9,400+ servers in 224 locations worldwide. NordLynx protocol, post-quantum encryption, and independently verified no-logs policy.
Private Internet Access
Proven no-logs VPN with unlimited simultaneous connections, port forwarding, MACE ad-blocker, and a massive 10 Gbps server network.
Proton VPN
Swiss-based VPN with a generous free tier, Secure Core architecture, open-source apps, and independently audited no-logs policy.
Surfshark
Feature-packed VPN with unlimited simultaneous connections, RAM-only servers, CleanWeb ad blocking, and patented Everlink technology.
Windscribe
Generous free tier with 10 GB/month, unlimited simultaneous connections, unique R.O.B.E.R.T. custom DNS blocking, and IPv6 support.