TL;DR: A VPN kill switch (sometimes called a network lock) is a feature that instantly blocks all of your device's internet traffic the moment your VPN connection drops. Without it, the second your tunnel fails your real IP address, DNS queries, and traffic leak straight through your provider in the clear. With a kill switch on, that leak never happens: either you are protected by the VPN, or you have no internet at all. In 2026 it is a baseline feature for anyone who genuinely cares about privacy.
What a kill switch is and the problem it solves
A VPN builds an encrypted tunnel between your device and a server. While that tunnel is up, your traffic is protected, and your provider or a public Wi-Fi network sees only an encrypted stream to a single IP. But any connection can drop, and that is where the real problem starts. The instant the tunnel fails, your operating system does not wait for it to come back: it simply routes traffic the normal way, through your internet provider, with your real IP address attached.
A kill switch solves exactly this. It guards the route and, the moment the tunnel disappears, cuts off all traffic. Here is what it prevents:
- Real IP leak — websites and trackers never get to see your home or mobile IP address during the glitch.
- DNS query leak — the list of domains you open does not go straight to your provider (a DNS leak).
- Torrent client exposure — background apps often keep downloading without noticing the VPN dropped.
- Exposure on public networks — in a cafe or airport, even one second without encryption matters.
Why VPN connections drop in the first place
Many people assume a VPN tunnel is something stable and permanent. In practice, drops happen regularly, and most of the time you do not even notice them. Understanding the causes helps you judge how much you need a kill switch.
- Network switching — your phone hops from Wi-Fi to mobile data (or back), and the old tunnel breaks before the new one comes up.
- Sleep mode — after the device wakes, the VPN app needs time to reconnect, but traffic is already flowing.
- Server overload — too many clients on one node, or scheduled maintenance, can drop your session.
- Weak signal — flaky Wi-Fi or poor LTE coverage makes the connection flicker.
- Provider IP change — mobile carriers periodically rotate the address they assign you, killing active sessions.
We cover the causes of drops and how to fix them in detail in our guide on why a VPN will not connect and how to fix it.
How a kill switch works technically
The idea is simple: the software watches the state of the VPN tunnel (usually a virtual network adapter, such as a WireGuard interface) and, the moment it disappears, changes routing or firewall rules to forbid any outbound traffic outside the tunnel.
This is implemented in different ways. The most reliable approach uses the system firewall: the VPN app writes rules that only allow packets through the VPN interface and block everything else. A lighter version has the app itself monitor the state and shut down selected programs. The difference between these approaches defines the two main types of kill switch.
System-wide vs per-app kill switch
Before you enable the feature, it helps to know it comes in two flavors, and your choice decides how strictly traffic gets blocked.
- System-wide (full) kill switch — blocks all internet on the device when the VPN drops. The safest mode: no app reaches the network outside the tunnel.
- Per-app kill switch — cuts the connection only for selected programs (say, the browser and a torrent client), leaving others online. Convenient, but less strict.
- Reaction to a drop — the system-wide version reacts instantly at the routing level, while per-app sometimes fires a fraction of a second later.
- How to choose — for maximum privacy go system-wide; per-app suits cases where some services must run without the VPN.
How a kill switch differs from DNS leak protection
These two features are often confused, but they close different holes. DNS leak protection ensures your DNS queries go through the VPN's DNS server rather than your provider's while the tunnel is up. A kill switch instead insures the moment of the drop, when there is no tunnel anymore.
- DNS leak protection — works while the VPN is connected and stops queries from leaking to your provider.
- IPv6 leak protection — disables or tunnels IPv6, which many older VPNs ignore, leaving an open leak channel.
- Kill switch — steps in the moment the tunnel falls and blocks all traffic wholesale.
- Together — only the combination of all three mechanisms gives you truly airtight privacy.
How to confirm all three mechanisms work for yourself is covered in our guide on how to test that your VPN is actually working.
Kill switch on Windows, macOS, iOS, and Android
The implementation differs noticeably between platforms — on some it is baked deeper into the system, on others it is constrained by app store rules.
- Windows — the most flexible: the kill switch usually works through a filtering driver (WFP) and supports both full and per-app modes.
- macOS — implemented through a system Network Extension and firewall; the full kill switch is reliable, while per-app depends on the app.
- iOS — there is a built-in On-Demand option in the VPN profile that acts as a system kill switch and keeps traffic from flowing without the tunnel.
- Android — the OS ships an Always-on VPN and a Block connections without VPN toggle in network settings, independent of any single app.
When you should keep the kill switch on
The feature is useful almost always, but in some scenarios it is simply mandatory. Check whether you fall into one of these groups.
- Public Wi-Fi — in cafes, hotels, and airports the interception risk is at its highest; keep the kill switch on at all times. We dig into this in our article on staying safe on public Wi-Fi networks.
- Handling sensitive data — your banking app, work email, and corporate systems should never sit in an open channel for even a moment.
- Torrents and P2P — a background download will not notice a drop and can easily expose your IP without an emergency block.
- Bypassing blocks — if anonymity is the whole point, any leak of your real IP undoes the effort.
Downsides and gotchas of a kill switch
The feature has a flip side worth stating honestly. The main trade-off is between security and convenience.
- No VPN means no internet — if the server fails or drops, you are left fully offline until the VPN reconnects.
- False triggers — when you switch networks often, the kill switch may cut your internet more frequently than you would like.
- Local network issues — strict mode can sometimes block access to a printer, NAS, or other devices on your home network.
- Captive portals — a hotel or cafe captive portal may not open while the kill switch is active, since its login happens outside the VPN.
How to enable and test a kill switch
Enabling it usually comes down to a single toggle in the VPN app's settings or in your system network options. Testing, though, is a step many people skip, and that is a mistake.
- Turn the feature on — find the Kill Switch, Network Lock, or Block connections without VPN item in the app and activate it.
- Run an IP check — open an IP detection site with the VPN active and note the server address.
- Simulate a drop — manually disconnect the VPN server (not the whole app) and reload the page: the internet should die, not reveal your real IP.
- Check DNS — use an online DNS leak test to confirm queries are not slipping outside the tunnel.
- Restore the connection — reconnect the VPN and confirm network access comes back automatically.
FAQ
Is a kill switch the same as turning off the VPN?
No, it is the opposite. A kill switch does not turn off the VPN; it protects you when the VPN drops on its own by blocking the internet so traffic cannot route around the tunnel with your real IP.
Do I need a kill switch if I just watch videos?
For ordinary streaming with no anonymity requirements it is not critical. But if you are on public Wi-Fi or it matters that your real IP stays hidden, it is better to keep the kill switch on.
Does a kill switch slow down internet speed?
No. The feature itself does not affect speed — it only watches the tunnel's state and fires only at the moment of a drop. Throughput depends on the protocol (such as WireGuard) and the server, not the kill switch.
Why does the internet go completely dead with a kill switch on?
That is exactly its job: when the VPN drops it deliberately blocks all traffic to rule out a leak. As soon as the tunnel is restored, network access comes back automatically.
Is there a kill switch on iPhone and Android?
Yes. On iOS the On-Demand option plays the role of a system kill switch, and on Android the Always-on VPN plus Block connections without VPN settings do the same. They work at the OS level.
Does a kill switch protect against DNS leaks?
Partly. A kill switch blocks traffic when the tunnel drops, but a separate DNS leak protection feature handles leaks during an active connection. For full airtight coverage you need both features together.
Why try Limp Secure VPN
Limp Secure VPN is built on the WireGuard protocol, so the connection stays fast and stable and drops happen less often. But for those moments anyway, the app includes a system-wide kill switch: when the tunnel is lost, all traffic is blocked, and your real IP, DNS queries, and data do not leak for even a fraction of a second. DNS leak and IPv6 leak protection are on by default.
- Strict no-logs policy — we keep no logs of your activity, connection history, or the sites you visit.
- One account, every platform — Limp Secure VPN runs on iOS, Android, Windows, and macOS with kill switch support.
- Fair price — just 100 rubles a month with no hidden fees and no surcharge for premium privacy.
- Fast WireGuard — the modern protocol delivers high speed and a stable connection even when you switch networks.
Conclusion
A kill switch is not a marketing toggle but a real privacy safety net. It covers the most vulnerable moment of any VPN — the seconds between a drop and a reconnect, when your true IP and DNS queries can leak to your provider. Once you understand how the feature works, how system-wide mode differs from per-app, and how to test the protection, you can set up your VPN to be genuinely secure. If privacy is more than a buzzword to you, keep the kill switch on — and Limp Secure VPN will make sure it fires reliably and without needless friction.