What is a VPN kill switch and when should you use one?

A kill switch is a security feature that protects your privacy. It ensures that you don’t connect to the internet thinking you’re protected by a VPN when you aren’t. 

When you use a virtual private network (VPN), your device connects to VPN server run by a VPN service such as Proton VPN. The connection between your device and VPN server is encrypted.

This means your internet service provider (ISP) can’t see what you do on the internet (only that you’ve connected to a VPN server), and anyone on the internet (such as websites and P2P peers) can’t see your real IP address (only that of the VPN server).

Learn more about how a VPN works 

However, if your VPN connection fails for any reason, your ISP will be able to see any connections you make on internet, and websites, P2P peers, and anyone else you’re connected to on the internet, will be able to identify you through your unique internet protocol (IP) address. 

Learn more about IP addresses

How a VPN works

A kill switch (if implemented correctly) prevents this. If you disconnect from a VPN server unexpectedly, a kill switch blocks all external network traffic to and from your device until either the VPN connection is reestablished or you disable the kill switch. 

How does a kill switch work?

There are basically two kinds of kill switches:

Reactive kill switches

A reactive kill switch monitors your device’s internet connection to ensure it is connected to a VPN server. If it detects that it isn’t, the kill switch closes down your internet connection. Reactive kill switches are not well regarded by security professions for two main reasons:

1. There is an inevitable delay between the VPN connection dropping, the kill switch detecting the drop, and then terminating your internet connection. This delay might be only milliseconds, but that’s enough time for your real IP address to be exposed to the internet.

2. Reactive kill switches are usually not good at detecting connections that your operating system might make outside the VPN interface. They might, for example, monitor your IPv4 connection to ensure the VPN connection is active, while being completely unaware that your device is connecting to a server via IPv6, and thus exposing its IPv6 address. 

Fortunately, these limitations mean that reactive kill switches are rarely used these days.

System-level kill switches

A system-level kill switch uses firewall rules and other platform-specific mechanisms to ensure that no traffic can enter or exit your device outside the VPN interface.

On Windows, most VPN kill switches use the Windows Filtering Platform(new window), while Android 8.0+ features a built-in Always-On VPN & Kill Switch setting. macOS and iOS devices have their own mechanisms, but these are flawed. We’ll discuss this later in this article. 

Properly-configured, a system-level kill switch makes it impossible to connect to the internet without an active VPN connection. Since no connections can enter or leave your device outside its VPN interface, if the VPN interface isn’t active, then no connections are possible.

System-level kill switches are passive, and therefore much more reliable than reactive kill switches. There is no need to detect if a VPN connection is working, so no need to close the internet connection. If the VPN connection isn’t active, then no internet connection is possible. 

The engineering required to build a good system-level kill switch also ensures that IPv6 leaks and DNS leaks are also impossible when the VPN is active. It also ensures that nothing is leaked during the connection process and when switching between VPN servers.  


As noted above, system-level kill switches are built using platform-specific mechanisms. This means VPN services must develop separate kill switch solutions for each platform they support. The result is that some VPN services advertise that they offer a kill switch, but the feature is only available on some platforms.

Proton VPN offers a full system-level kill switch on all platforms that we support — Windows, macOS, iOS/iPadOS, Linux, Linux CLI (and, of course, Android). 

Kill switch modes

Usually, a kill switch only engages when you start a VPN connection, and is disabled when you manually disconnect the VPN or shut down your device. When the VPN is disconnected, you can access the internet as normal. 

It is also possible to run a kill switch so that all internet activity is disabled unless the VPN connection is active. This way of running a kill switch can be less convenient, as you can’t simply turn the VPN off without additional steps required to access the internet). However, it ensures that you never accidentally connect to the internet without the VPN enabled. 

This is especially effective when you boot up a device, as it prevents apps that load before the VPN client (for example, a torrent client) from establishing an internet connection before the VPN tunnel is created.

At Proton VPN, we call this kill switch mode a permanent kill switch, which is available on our Windows app.

Learn more about our permanent kill switch

Who needs a kill switch?

A kill switch helps to ensure you never access the internet thinking that you’re protected with a VPN, when you aren’t. As such, a kill switch is an invaluable privacy and security tool for activists, journalists, anyone who uses a VPN to stay private on the internet. 

It’s worth noting that when simply surfing the web, your real IP address usually only becomes exposed when you actively click on a link or type in a URL. However, this is not true for P2P downloaders, who often leave their active connections to P2P peers unattended for long periods of time. This make using a kill switches particularly important for torrenters.  

A note on kill switches and Apple

A number of vulnerabilities have been discovered in how Apple implements VPN connections on its macOS, iOS, and iPadOS platforms. This includes routing traffic from Apple apps directly to Apple, regardless of whether a kill switch is enabled. 

This problem affects all VPN services, although Proton VPN has introduced a number of measures to mitigate against it.

Final thoughts

A kill switch ensures that if a VPN connection fails, your real IP address isn’t exposed to websites you visit, and the websites you visit aren’t exposed to your ISP. If privacy is even a small part of why you use a VPN, you should enable a kill switch. 

Protect your privacy and security online
Get Proton VPN free

Related articles

Paris Olympics
The 2024 Summer Olympics in Paris begins this July. While you’ve likely already missed your chance to get a ticket and witness the best athletes from around the world in person, there are plenty of ways to enjoy the games from the comfort of your hom
Where to watch euros
Every four years, the entire continent of Europe turns its eyes to see who will be crowned as the continent’s champion of football (or soccer for the Americans).  This is the 17th edition of the UEFA European Football Championship, in which 24 natio
How to enable location services
Location services refer to a combination of technologies used in devices like smartphones and computers that use data from your device’s GPS, WiFi, mobile (cellular networks), and sometimes even Bluetooth connections to determine and track your geogr
What is AirTag stalking?
In an era of “smart devices” that often double as spy devices, AirTags are tracking tools that are open about their function and can be vital in helping locate lost items (as anyone who has lost their car keys can attest to). However, as a recent cla
How to fix a "Your connection is not safe" error
As you surf the web using your browser, you’ll no doubt encounter websites that your browser will refuse to load, instead showing some variation of an error message, such as Your connection is not private or Warning: Potential Security Risk Ahead. 
Your search history is a window into your inner life. Anyone with access to it knows what your hobbies and interests are, your sexual orientation and preferences, the things that worry you (for example your medical concerns), your political affiliati