What is a VPN kill switch and how does it work? (+ setup guide for different devices)

A VPN masks your IP address, encrypts your traffic, and conceals your activity from third parties and potential eavesdroppers—until the moment the connection drops.

That short gap is all it takes for apps to slip back to the open internet and expose your IP, location, or downloads. A VPN kill switch is the safety net that steps in to stop that from happening.

This guide unpacks what the feature does, why it matters, and how you can set it up on Windows, macOS, Android, and iOS. You’ll also see why ExpressVPN’s Network Lock sets the bar for leak protection.

VPN kill switch: Definition and purpose

What does a VPN kill switch do?

A VPN kill switch shields you from accidental leaks when your VPN connection drops. It constantly checks that your traffic is still passing through the encrypted VPN tunnel between your device and a VPN server. If the tunnel drops—even for a split second—the switch blocks all internet activity until the connection is safely restored.

Like a circuit breaker, it cuts power (data) the instant something slips outside the protected line, keeping your IP address, DNS requests, and downloads from exposure.

Why you might need one

If you need a VPN, you need a kill switch. There are moments when your VPN connection might fail. When this happens, your device could automatically switch back to an unsecured internet connection, risking exposure of your IP address and data transmissions. A kill switch prevents this.

Kill switch vs. no kill switch: What’s at risk?

A kill switch isn’t a luxury add-on; it’s the difference between a clean cut-off and an instant leak that can hamper your online privacy. Here’s what’s at risk without one:

How does a VPN kill switch work, and when does it activate?

What happens when your VPN disconnects

When the tunnel snaps—even for a second—your device falls back to its normal, unprotected path. Without a kill switch, here’s what can leak in that split-second window:

A system-level kill switch—like ExpressVPN’s Network Lock—plugs that hole. It slams the firewall shut the moment the VPN drops, so the worst you experience is a brief pause in connectivity, not a full-blown privacy breach.

How a kill switch prevents IP and DNS leaks

A leak is a leak, but IP leaks and DNS leaks happen through two different escape hatches—the route table (your OS’s internal map that decides where each data packet goes) and the DNS resolver (the service that turns domain names into IP addresses). A robust kill switch seals both.

ExpressVPN’s Network Lock takes this comprehensive approach, so neither your real IP nor a single domain request leaks during a drop.

Common scenarios that trigger a kill switch

1. Switching between VPN servers

There’s a brief hand-off between disconnecting from the old server and establishing a tunnel to the new one. If any of your apps push or pull data during that gap, your real IP could flash unless the kill switch—ExpressVPN’s Network Lock, for example—blocks traffic until the fresh connection is secured.

2. Malicious apps attempting to bypass the VPN

Some programs try to open their own direct sockets, ignoring system-wide VPN settings. A robust, system-level kill switch steps in before that traffic leaves the device, ensuring nothing slips past the encrypted tunnel.

3. Bandwidth throttling

Congested networks force ISPs to throttle users’ speeds. Those slowdowns can cause timeouts that drop the VPN handshake. A kill switch prevents any resulting leak by stopping traffic until the tunnel is rebuilt.

4. Unstable public Wi-Fi

A weak café signal can make devices hop between Wi-Fi and cellular, interrupting the VPN. The same scenario happens when you switch from one network to another, e.g., from your home Wi-Fi to mobile data. There are a few seconds when this happens where your connection will go unprotected by the VPN. The kill switch freezes packets during each hop, so your browsing session never spills onto the open network.

5. Other triggers

These include simply closing your laptop lid, a momentary ISP hiccup, or a manual quit of the VPN app—events that a continuous connection monitor catches and covers automatically.

Does the VPN reconnect automatically?

Quality VPN apps immediately try to re-establish the tunnel. Once reconnected, the kill switch lifts, and you’re back online, usually in under a second. ExpressVPN, for example, cycles through Lightway, OpenVPN, and IKEv2 VPN protocols in the background until a stable tunnel forms, then lifts the block in seconds—all without user input.

Types of VPN kill switches

Application-level kill switch

This kill switch offers granular control over which applications are affected by a VPN disconnection. It lets you choose specific applications to disconnect from the internet if your VPN connection drops. This targeted approach means you can safeguard critical activities like browsing and banking, while less sensitive applications, such as music streaming, continue uninterrupted.

However, the flexibility can come at the cost of comprehensive security, as non-selected applications remain unprotected.

System-level kill switch

This type is also known as a firewall-level or network-level kill switch and is generally considered the more secure type of kill switch. It offers the most robust protection by blocking all internet traffic if your VPN connection fails.

This comprehensive approach guarantees that no data escapes your device outside the secure VPN tunnel, effectively preventing any potential data leaks across all applications.

Advanced or persistent kill switch

This type of kill switch (sometimes also referred to as a permanent kill switch) takes the concept of a system-level kill switch a step further to offer an even more uncompromising level of protection. It’s a proactive, constant guard that makes unprotected internet access impossible by default, only allowing traffic when the VPN is securely connected.

These switches also survive app crashes or device reboots, blocking traffic until the VPN links up again.

How to enable a VPN kill switch on your device

Windows

1. Open ExpressVPN and go to Options > General.
2. Tick Stop all internet traffic if the VPN disconnects unexpectedly.
3. The rule loads at boot and protects every process.

macOS

1. Open ExpressVPN and go to Preferences.
2. Tick Stop all internet traffic if the VPN disconnects unexpectedly.
3. The packet filter enforces the block system-wide.

Android

1. Inside the app, select Profile and toggle on Kill Switch.
2. Your phone now blocks leaks, even while you move between networks.

You can also choose Always block all non-VPN internet traffic; it’s more secure, but it will also disable VPN features like split tunneling. Here’s how to do it:

1. Under Internet Kill Switch, tap Learn more.
2. In the prompt, tap ANDROID SETTINGS.
3. Tap the gear icon next to ExpressVPN.
4. Toggle Always-on VPN and Block connections without VPN on.

iOS

1. In the ExpressVPN app, click the hamburger menu icon and go to Preferences. Toggle on Stop all internet traffic if the VPN disconnects unexpectedly.
2. This keeps traffic blocked until the VPN is running.

ExpressVPN’s kill switch: Network Lock explained

How Network Lock works on desktop and mobile

ExpressVPN’s Network Lock inserts firewall rules on Windows, macOS, and Linux, and it taps into the always-on frameworks on Android and iOS. It begins with a “block everything” firewall rule on all desktop platforms.

A second rule then allows only VPN-routed traffic. These rules stay active through the entire connection cycle, including during reconnects and disruptions, ensuring consistent protection.

Network Lock covers both IPv4 and IPv6 network traffic to prevent any data from leaking outside the VPN tunnel. This total coverage ensures your personal information and activities remain private, even amid network instability or when switching Wi-Fi networks.

How it compares to other VPNs

Some providers have their kill switch disabled by default or limit it to desktop apps. Network Lock, on the other hand, is active on first launch and works perfectly on mobile and other platforms as well as desktop.

It can also protect every device in your home because it covers routers, too—you can use ExpressVPN’s dedicated Aircove router or install the ExpressVPN firmware onto any compatible router.

Security advantages of ExpressVPN’s implementation

• On by default—no extra clicks.
• Works with the Lightway protocol, so reconnections can finish in milliseconds.
• Can cover every device behind a router, including smart home gadgets that can’t install apps.
• Independent audits confirm zero leaks during stress tests.

Should you ever disable a VPN kill switch?

Pros and cons of manual deactivation

When it might make sense to disconnect

While it’s advisable to keep the kill switch enabled to secure your data continuously, there may be specific scenarios where you need to disable it temporarily. Here are a few reasons that make sense:

• If you’re on a trusted home network and need short-term access to sites that block VPN addresses.
• For troubleshooting connection issues or adjusting network settings, e.g., a hotel Wi-Fi portal or public hotspot that won’t load its sign-in page until the device briefly connects without the VPN/kill-switch firewall in place.
• When gaming on LAN, where brief IP exposure doesn’t matter.
• On metered data, where failed uploads cost money.

Otherwise, leave it on.

How to choose a VPN with a kill switch

A kill switch is an important part of maintaining your online privacy and security. So, before choosing a VPN, check whether a kill switch is offered and how it functions across different devices and operating systems. Here are key factors to consider:

• Supported platforms: Pick a service that brings the feature to every operating system you use. ExpressVPN supports desktop, mobile, and routers.
• Default activation and user control: A default-on switch protects newcomers; a visible toggle satisfies power users. ExpressVPN’s Network Lock balances both.
• Level of protection offered: System-level and persistent modes beat app-only shutdowns. Look for wording that promises device-wide blocking, not just application control.
• Transparency and privacy policies: Independent audits, open-source modules, and clear documentation build trust. ExpressVPN publishes annual assessments and hosts Lightway’s code on GitHub.