VPN Kill Switch Explained: Why Remote Workers Need It (2026)

What Is a Kill Switch?

Picture this. You're in a cafe, connected to VPN, sending client files. VPN hiccups for half a second. Without a kill switch? Your traffic instantly routes through the open network. Real IP exposed.data readable. And you probably didn't even notice it happened.

A kill switch cuts your internet the moment VPN drops. Nothing in, nothing out. Paranoid? Maybe. But I've seen what happens on cafe WiFi.

How It Works

Pretty simple actually:

1. Kill switch watches your VPN connection constantly
2. VPN drops (server restart, WiFi hiccup, whatever)
3. All traffic blocked. Immediately.
4. Stays blocked until VPN reconnects
5. Back to normal

This happens in milliseconds. Even a half-second drop can't leak data because the kill switch is faster.

Why You Actually Need This

VPNs drop more than you'd think:

• Server updates (VPN companies do maintenance)
• Switching networks (WiFi to cellular, between access points)
• Crappy WiFi (hotels, airports, cafes)
• Random ISP issues
• Software conflicts on your machine

What Leaks Without Protection

• Your real IP. Location revealed.
• Whatever you were sending. Readable.
• Login sessions. Yikes.
• Every site you're visiting

On public WiFi, this happens in front of everyone. Including anyone specifically hunting on that network. It happens.

Three Types of Kill Switches

App-Level

Blocks only specific apps you choose. Browser keeps working, everything else too. Problem? Anything you forgot to add still leaks.

System-Level

Blocks everything. Complete protection. All apps lose internet when VPN drops. This is what I use.

Permanent

Blocks ALL non-VPN traffic, always. Even when VPN app isn't running. Can't accidentally browse unprotected. Very strict though. Can lock you out.

My Take

System-level for most people. Complete protection without being annoying.

Best VPNs for Kill Switch

NordVPN

Both app-level and system-level options. The system-wide one ("Internet Kill Switch") blocks everything. Tested it myself. Works.

ExpressVPN

Calls theirs "Network Lock." System-level, extremely reliable. Caught every simulated drop in my testing. Zero leakage.

Heads up for 2026: ExpressVPN renamed Network Lock to "Internet Kill Switch." Same feature, new label. It's in the Windows, Mac, Linux, router, Android and iOS apps.

ProtonVPN

Has a permanent option. Your device literally can't access internet without VPN running. Great for high-security situations.

Turn It On (Device by Device)

Most VPN apps ship with the kill switch off. Annoying, but that's how it is. Here's where to look.

Windows and Mac

Inside the VPN app. NordVPN has it under settings as "Kill Switch," with separate toggles for the Internet Kill Switch and the App Kill Switch. ExpressVPN puts its Internet Kill Switch in the app options. Flip the system-wide one on and forget about it.

Android

Android has its own version built in, which is nice. Go to Settings, search "VPN," tap the gear next to your VPN, and turn on Always-on VPN. Then turn on "Block connections without VPN." That second toggle is the real kill switch. Works on Android 7 and up.

iPhone and iPad

No system toggle here. You rely on the app. ExpressVPN and NordVPN both have one for iOS. Read the next section before you trust it completely, though.

Linux

NordVPN's Linux app is command line. nordvpn set killswitch 1 turns it on, 0 turns it off. If your internet dies after you disconnect, that's the kill switch doing its job. Turn it off first.

Where Kill Switches Fall Short

A kill switch catches drops. It doesn't catch everything. Two things worth knowing about.

TunnelVision

In May 2024, Leviathan Security published an attack called TunnelVision (CVE-2024-3661). Someone on the same network runs a rogue DHCP server and uses option 121 to push routes that pull your traffic outside the VPN tunnel. The VPN looks connected the whole time. So the kill switch never fires. Researchers said there isn't a full fix on every major OS.

Proton says its app is broadly resistant on Android and Windows, and elsewhere once you turn on the right settings. On sketchy public WiFi, this is one more reason to use your phone's hotspot instead when it matters.

iOS Leaks

iPhones have a long-running problem. Proton reported back in 2020 that iOS keeps some existing connections outside the tunnel. Apple added a kill switch option for developers in iOS 14, but Proton found in 2022 that some Apple service traffic still leaks. IVPN went as far as removing its iOS kill switch in 2023 because of it. As of 2025, security researcher Michael Horowitz was still documenting leaks. The takeaway: on iPhone, a kill switch helps, but it's not airtight.

Split Tunneling Conflicts

Using split tunneling so some apps skip the VPN? NordVPN has a whole support page on how the two interact, because they can conflict. Read it before you combine them.

Test Yours. Seriously.

Don't assume it works. Test it:

Quick Test

1. Connect VPN, verify your IP changed
2. Open terminal, run continuous ping: ping google.com -t
3. Kill your VPN (simulate a drop)
4. Pings should stop immediately
5. Reconnect. Pings resume

If It Fails

If your real IP showed up or pings continued? Kill switch isn't working. Check settings. Update the app. Or switch VPNs.

Bottom Line

Had a scare at a coworking space in Lisbon last year. VPN dropped for maybe ten seconds while I was logged into a client's admin panel. Didn't notice until later. Might have been fine. Might not have. Kill switch would've blocked everything instantly.

So yeah. Turn it on. Settings, kill switch, enable. System-level if your VPN offers it. Takes about fifteen seconds.

Your VPN doesn't have a reliable one? That's a reason to switch. NordVPN and ExpressVPN both get this right.