How to Set Up a VPN Kill Switch

To set up a VPN kill switch, open your VPN app's settings, find the option named Kill Switch or Network Lock, and turn it on — that's all most people need. If your setup has no app-level switch, your operating system can enforce one instead. This guide covers both routes on each platform and shows how to test that it works, so a dropped connection never exposes your real IP.

Why turn it on during setup

A kill switch matters because VPN connections occasionally drop — a server hiccup, a network change, a device waking from sleep. In those seconds, without a kill switch, your device falls back to the normal connection and briefly uses your real IP. The kill switch prevents that by blocking traffic until the VPN is back. Because many apps ship with it off, turning it on is a genuine setup step, not an advanced tweak.

App-level kill switch (the easy route)

Almost every major provider's app has a kill switch built in; you just have to enable it. The steps are the same across platforms:

1. Open the app and go to Settings, then look under a Security, Connection or Advanced section.
2. Find the toggle called Kill Switch, Network Lock, or Always-on protection, and switch it on.
3. If offered a choice between an app kill switch and a full/system kill switch, pick the full one — it blocks all traffic, not just the provider's own app, when the VPN is down.

Some Windows apps distinguish between an internet kill switch (blocks everything) and an app kill switch (closes only chosen programs). For general protection, the internet kill switch is the one to enable.

System-level kill switch (when there's no app toggle)

If you set up a manual connection with no app, the operating system can enforce the same effect. On Android, Settings, VPN, the gear next to your app, then enable Always-on VPN and 'Block connections without VPN' — this is a true system kill switch. On Linux, firewall rules that drop all traffic unless it goes through the VPN interface do the job; some providers' CLIs set this for you. On Windows and Mac, a manual profile has no kill switch, so if you need one, use the provider's app instead of the built-in client.

Test that it works

You can verify a kill switch safely. With the VPN connected and a page loading, simulate a drop: switch the app to a different server, or briefly toggle your Wi-Fi off and on. During the reconnect, your internet should pause rather than flicker back to your normal connection. For a firmer test, disconnect the VPN from within the app while the kill switch is on — a full/system kill switch will cut internet until you reconnect or disable it. If pages keep loading with your real IP during a drop, the kill switch isn't set up correctly.

Where it fits in setup

Enabling the kill switch is part of a complete first-time setup, alongside auto-connect and confirming your DNS. Follow the full how to set up a VPN walkthrough for the whole sequence, and see the first VPN settings to change for the other toggles worth flipping on day one.

Kill switch and everyday use

A kill switch is meant to be invisible until something goes wrong, but it does change a few everyday moments, so it helps to know what to expect. When you switch servers, some apps briefly hold traffic — that pause is the kill switch doing its job during the handover, not a fault. When your laptop wakes from sleep, you may see a second of no connectivity while the VPN re-establishes and the switch lifts. And if you ever find your internet is down for no clear reason, check whether the VPN quietly disconnected: with a full kill switch on, a dropped tunnel looks exactly like 'no internet' until you reconnect or turn the switch off.

That last point trips people up, so it's worth internalising: the kill switch trades a little convenience for the guarantee that you never leak your real IP during a drop. That's the right trade for most people, but it's why a stalled connection should send you to the VPN app first.

It's not a substitute for the VPN itself

A kill switch protects against a specific failure — the VPN dropping without you noticing. It does not do anything the VPN itself doesn't: it won't make you anonymous, won't encrypt traffic you've deliberately routed outside the VPN with split tunnelling, and won't help if you simply forgot to connect. Think of it as a seatbelt for the connection you already set up, not a feature that adds protection of its own.

Pair the kill switch with auto-connect on untrusted networks and you close the two biggest gaps at once: forgetting to turn the VPN on, and the VPN dropping while you're not watching. Those two settings together are what turn a working install into one you can rely on without thinking about it.

Bottom line

Setting up a kill switch is usually a single toggle in your VPN app — find Kill Switch or Network Lock, choose the full or system option over the app-only one, and turn it on. If you run a manual connection with no app, Android's Always-on VPN with 'Block connections without VPN' and Linux firewall rules give you the same protection, while manual profiles on Windows and Mac have none, so use the app there. Test it by switching servers or disconnecting and watching traffic pause rather than fall back to your real IP. Expect small pauses when changing servers or waking from sleep — that's the switch working, not a fault. It's a seatbelt for a dropped connection, nothing more, so pair it with auto-connect to also cover the times you'd otherwise forget to connect. Together they make a working install genuinely dependable.