VPN kill switch
Updated 21 September 2026 · How we research
A kill switch blocks your traffic when the tunnel is not up. It exists because the dangerous moment is not when a VPN is connected — it is the few seconds after it silently drops, when your device cheerfully falls back to the ordinary connection.
Kill switch: fail closed, not exposed
A kill switch is designed to stop unprotected traffic when the VPN tunnel drops.
Tunnel connected
Traffic follows the protected VPN route.
PROTECTED PATH ACTIVE
Tunnel drops
The app detects a failed or interrupted connection.
CONNECTION EVENT
Traffic blocked
Internet access stays blocked until protection returns.
FAIL-CLOSED STATE
Test it
Record OS, app version, protocol, traffic type, drop method, observed IP/DNS behaviour and recovery time.
How it is implemented
A real kill switch is a firewall rule, not an application setting. The client installs a rule that permits traffic only on the virtual interface, plus the single route needed to reach the VPN server. If the interface goes away, nothing matches the permit rule and traffic stops.
Kill switches are operating-system features that clients drive. Where the OS offers its own control, prefer it.
| Platform | Mechanism | Practical caveat |
|---|---|---|
| Windows | Windows Filtering Platform rules | Generally robust, including across sleep and wake |
| macOS | Packet filter or Network Extension rules | Behaviour on wake can vary between client implementations |
| Linux | iptables or nftables rules | Strongest when the client also handles reboot persistence |
| Android | System "Always-on VPN" with "Block connections without VPN" | The OS-level toggle is more reliable than an in-app switch |
| iOS | Network Extension, with per-app VPN reserved for managed devices | The OS may allow brief system traffic outside the tunnel |
Use the Android system toggle
The failure modes worth testing
- Process crash. End the VPN client process from the task manager. Traffic should stop immediately, not continue.
- Network change. Switch from Wi-Fi to cellular, or disconnect and reconnect Wi-Fi.
- Sleep and wake. Suspend the machine for a few minutes and check what happens in the first seconds after it wakes.
- Reboot. Restart with the client set to autostart and see whether anything escapes before the tunnel comes up.
- Server change. Switch servers inside the app and watch for a gap during the handover.
Step-by-step verification is covered in how to test a VPN.
What ZoogVPN states
According to ZoogVPN
Save 82%ZoogVPN lists kill-switch support across its Windows, macOS, Android and iOS apps.
2-year plans
Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.