What a Kill Switch Is
When your VPN connection drops unexpectedly, your device reverts to your real IP address. This happens instantly and without any warning. A kill switch detects the VPN disconnect and immediately blocks all internet traffic until the VPN reconnects. The result: your real IP never leaks, even for a fraction of a second.
Without a kill switch, a dropped VPN connection is invisible to you. Your browser keeps loading pages, your torrent client keeps seeding, your chat app keeps sending messages. All of it over your real IP.
Why VPN Connections Drop
VPN connections are not perfectly stable. Several things cause them to drop:
Server-side issues. A VPN server can become overloaded or go offline for maintenance. When the server drops, so does your connection.
Network switching. Moving from a WiFi network to a cellular connection changes your device's IP address. Many VPN apps fail to reconnect seamlessly during this transition, and for a few seconds you are unprotected.
Router interruptions. Your home router briefly losing internet connectivity will kill an active VPN tunnel. This happens more often than most people notice.
Sleep mode. When a laptop goes to sleep and wakes up, some VPN apps pause. The VPN reconnects within seconds, but those seconds count.
Poor signal. In low-signal areas, your internet connection can drop and reconnect repeatedly. Each reconnection is an opportunity for the VPN to fail.
Who Needs a Kill Switch
Not everyone needs a kill switch equally. Here is an honest breakdown:
Torrent users. This is the clearest case. If your VPN drops during an active torrent session, your real IP address appears in the swarm. Copyright enforcement agencies monitor these swarms specifically to log real IPs. A kill switch prevents this.
Journalists and activists in hostile environments. For anyone in a country where a dropped VPN connection can mean exposure to authorities, a kill switch is not optional. One second of unprotected traffic can be enough to identify a connection.
Corporate VPN users. A dropped connection while connected to a corporate VPN tunnel can briefly expose corporate network access credentials or traffic. For anyone handling sensitive business communications, a kill switch is a basic precaution.
Anyone who needs always-on privacy. If your threat model requires that your real IP never appears anywhere, a kill switch is the only way to guarantee that.
Who does not urgently need it: Casual streaming VPN users. If your VPN drops while watching Netflix, the worst outcome is that Netflix shows a region-unavailable error. Switch server and continue. No privacy risk. General browsing users who use a VPN mainly to avoid ad tracking also face minimal risk from a brief drop.
How to Enable It
Most major VPN providers include a kill switch, but it is often disabled by default.
NordVPN: Settings, then Kill Switch, then toggle the switch on. NordVPN also offers an app-level kill switch that applies only to specific applications, which is useful if you want your torrent client protected but your browser to continue normally.
ExpressVPN: Preferences, then General, then enable the VPN kill switch option. ExpressVPN calls it Network Lock on desktop.
Mullvad: The kill switch is always on by default. This is one of the main reasons privacy-focused users choose Mullvad. You cannot accidentally leave it off.
OpenVPN (manual setup): Requires adding firewall rules to block all traffic except through the VPN interface. On Linux, this means iptables rules that drop packets not bound for the tun0 interface. On Windows, this requires Windows Firewall rules. More complex, but fully configurable.
Testing Your Kill Switch
Do not assume your kill switch works without testing it. The process takes two minutes:
- Connect to your VPN.
- Open whatismyip.com and note your VPN IP address.
- Force-disconnect the VPN app. Important: do not just switch servers. Actually quit or kill the application process.
- Immediately open whatismyip.com again.
- If you see your real IP address, the kill switch failed or is not enabled.
- Reconnect your VPN and verify the VPN IP is back.
The critical step is force-quitting the app rather than using the built-in disconnect button. Some kill switches only trigger on connection drops, not on clean disconnects. Testing with a clean disconnect misses this gap.
Split Tunneling and Kill Switches
Some VPN providers let you apply the kill switch selectively to specific applications. This is called an app-level kill switch or per-app kill switch.
A practical setup: your torrent client gets kill-switched, so if the VPN drops during a download session, the torrent client stops immediately. Your browser continues normally if the VPN drops, because a brief IP exposure while browsing is an acceptable risk for you.
NordVPN and ExpressVPN both support this on desktop. Mullvad applies the kill switch system-wide with no per-app option, which is more secure but less flexible.
System-Level vs App-Level Kill Switches
There is an important technical distinction between the two implementation types.
An app-level kill switch monitors the VPN app process and blocks traffic when it detects a disconnection event. This works well in normal operation, but fails if the VPN app crashes completely without sending a disconnect signal.
A system-level kill switch uses firewall rules at the OS level to block all non-VPN traffic. This works even if the VPN app crashes, because the firewall rules exist independently of the app. Mullvad and ProtonVPN use system-level kill switches. If reliability matters to you, prefer a VPN that implements kill switches at the OS level.
Recommendation
If you torrent, need always-on privacy, or operate in a high-risk environment: use Mullvad or ProtonVPN with the kill switch enabled and system-level firewall selected. Test it once after setup using the method above. Do not assume it works without testing.