What Is a VPN Kill Switch?

The problem a kill switch is trying to solve

If a VPN tunnel disappears, an operating system may normally continue using the regular network connection. That can restore connectivity quickly, but traffic that was expected to use the VPN may now leave through the ordinary route.

What a kill switch changes

A kill switch adds a policy: if the protected VPN path is unavailable, traffic covered by that policy should be blocked or restricted until the VPN is restored. The exact implementation can be firewall-based, route-based, application-specific, or integrated with operating-system VPN controls.

A kill switch does not make the VPN impossible to interrupt

The tunnel can still fail because Wi-Fi drops, the device sleeps, or the network changes. The kill switch is about what happens after that failure. It does not improve a weak Wi-Fi signal or repair an outage.

Full-device versus application-specific protection

Some designs try to block all ordinary internet traffic while the VPN is unavailable. Others only protect selected applications or a particular VPN profile. Users should understand which behavior their client actually implements rather than assuming every feature with the same name works identically.

How this relates to disconnect troubleshooting

If your VPN drops frequently, investigate the cause instead of treating the kill switch as the fix. The VPN Keeps Disconnecting guide focuses on the underlying stability problem.

Failure behavior should be understandable

A useful kill-switch design makes the blocked state clear. Otherwise a user may think the internet is broken when the client is intentionally preventing fallback traffic. Good status information should distinguish “VPN disconnected and traffic blocked” from “local network unavailable.”

How to think about testing

If you test kill-switch behavior, use a controlled non-sensitive activity and verify what happens to the public IP or connectivity when the tunnel is deliberately disconnected. The goal is to confirm the documented behavior, not to create repeated unstable network conditions during important work.

Frequently Asked Questions

Does a kill switch hide that I am using a VPN?

No. Its purpose is to control fallback traffic when the VPN is unavailable.

Is a kill switch the same as split tunneling?

No. Split tunneling decides which traffic should use the VPN. A kill switch controls what happens when a protected VPN path is unavailable.

Do I need one for every use case?

That depends on how important it is that selected traffic never fall back to the ordinary route and on the behavior of the specific device and client.

Related reading

Readers who want to test these concepts with a VPN client can use the ZBEVPN Download page. For connection-specific problems, start with the Guides & Knowledge Center.