What Is a VPN Kill Switch?

When you disconnect from a VPN, your web traffic is no longer encrypted or routed via a secure server. This can leave personally-identifying information including your IP address and browsing activity exposed.

If your VPN connection drops unexpectedly, your VPN’s kill switch should activate and block your device from connecting to the internet altogether. This prevents any data from traveling outside the encrypted VPN tunnel. VPN kill switches are therefore an essential security feature of any VPN application.

Sadly, not every VPN comes equipped with a kill switch. It’s also a feature that can vary greatly depending on the device, VPN protocol, and VPN service you’re using. Some VPN kill switches are more reliable than others, and some only activate under specific circumstances or on certain devices.

In this guide, you’ll also learn how a VPN kill switch works, why it’s vital for your VPN to have one, and which VPNs have the best kill switch.

VPN kill switches vary by VPN service and device. However, their basic purpose remains the same: to block your access to the internet when your VPN connection fails.

Without this safeguard, you run the risk of exposing your personal data to the internet if your connection drops unexpectedly.

You can watch the video below for a quick summary of what a VPN kill switch is and how to check it’s working:

To understand why kill switches are so important, you need to know how a VPN works to protect your traffic.

At any point during this process the VPN connection can suddenly stop, removing your data’s encryption and revealing your real IP address to the websites you’re visiting.

If you’ve been connected to the same VPN server for a while, all of your browsing activity using that server will now be traceable back to your public IP address. Similarly, your web traffic from this point onwards will be unencrypted and associated with your real IP.

A VPN kill switch ensures that your IP address and location remain private. We strongly recommend installing a VPN with kill switch enabled if you are concerned about ISP surveillance or what someone can do with your IP address.

Here’s what happens when your VPN connection fails without a kill switch enabled:

Here’s what happens when your VPN connection fails with a kill switch enabled:

How a kill switch works to protect your data can be broken down into four stages:

1. Monitoring

   The VPN kill switch constantly surveys your VPN connection, monitoring any changes in your network status or IP address.

2. Detecting

   Any change or disruption to your VPN connection is immediately detected by the kill switch.

3. Disconnecting

   The kill switch will respond by blocking your device’s connection to the internet or to specifically chosen applications.

   This response will vary by the type of kill switch your VPN provider offers.

4. Reconnecting

   Once your VPN connection is restored, the VPN kill switch deactivates and allows your internet connection to reestablish.

The Different Types of VPN Kill Switch

Though all kill switches will broadly follow the process outlined above, exactly how they work will depend on the type of kill switch in use.

Most importantly, VPN kill switches can vary by when they are engaged and how they are applied.

Active kill switches aren’t as secure because there is a minor delay between the VPN disconnecting and the kill switch receiving this information. During this period your data will be decrypted, unprotected, and broadcasting your real IP.

Passive kill switches are more secure and reliable, responding immediately to any changes in your network status. Fortunately, the majority of VPN providers are equipped with a passive kill switch.

System level kill switches are more commonly used by VPN providers as they offer greater protection. Disconnecting your entire device’s connection makes IP leaks far less likely.

Application level kill switches can be useful if you have a specific use-case for your VPN. For example, if you’re using a VPN to torrent then you may want to only block your torrenting client.

This offers greater flexibility as you can continue to browse freely while keeping your torrenting traffic safe.

What Causes a VPN Kill Switch to Activate?

Any disruption or change to your VPN connection will cause a VPN kill switch to engage and block your internet connection.

Your connection to a VPN server can be affected by a number of factors. We’ve outlined the main causes of VPN disconnections and their solutions below:

1. Weak Signal Strength

If your device experiences weak signal strength or a loss of internet connection then your VPN kill switch will engage.

To prevent this, avoid using less reliable networks such as mobile data or public WiFi. A strong and consistent internet connection is necessary for maintaining a VPN connection.

2. Strict Firewall Settings

Your operating system’s firewall may block or disrupt VPN connections causing the kill switch to activate.

Any system updates may also change your firewall settings and prevent VPN connections from being established.

To solve this, add your VPN service to the firewall’s list of permitted applications. This ensures that your VPN connection bypasses the firewall and future-proofs it for any further system updates.

Follow these steps to whitelist your VPN on Windows firewall:

1. Click the Windows Start button and open your Settings.
2. Go to Updates & Security > Windows Security > Firewall & network protection > Allow an app through firewall.
3. Then, select Change Settings and add the VPN Provider.
4. If you can’t find your VPN in this list then select Allow another app… > Browse. Search for your VPN and click add to confirm the change.
5. Once you’re finished click OK to save the changes.

Follow these steps to whitelist your VPN on macOS firewall:

1. Go to System Preferences > Security & Privacy > Firewall.
2. If prompted, select the lock symbol in the bottom left corner and enter your password.
3. Press unblock.
4. Then click Firewall options and click +.
5. Select your VPN and click add.
6. Once you’re finished click OK to save the changes.

3. Unreliable VPN Protocol

Any lapse in your internet or VPN connection can cause a kill switch to activate.

Many VPNs offer OpenVPN (UDP) as the default VPN protocol, which does not provide the most stable connection.

To avoid any unwanted kill switch activations, change your VPN protocol to OpenVPN (TCP).

The TCP protocol maintains a more stable VPN connection at the cost of reduced download speed.

You should keep a kill switch on at all times to ensure your data is kept private and secure.

However, there are specific use-cases when a kill switch is especially important:

Accessing Public WiFi

You are far more vulnerable to malicious attacks when using public WiFi. On a public network it’s not clear who set it up, who else is connected to it, and if it’s being monitored.

Installing a VPN on your device encrypts your traffic and routes it through a secure VPN server, concealing your real IP address and making it virtually impossible for your traffic to be monitored or altered.

Connecting to a public WiFi VPN without a kill switch undermines any protection your VPN offers. Enabling a kill switch ensures your sensitive data will remain safe on public WiFi, even in the event of a VPN disconnection.

Torrenting & P2P Activity

Torrenting should always be carried out with a VPN. It conceals your online activity and identity from any potential onlookers.

Without a safe torrenting VPN, your true IP address and identity will be visible to everyone else in the torrent swarm. This includes copyright trolls, your ISP, or even the content owners.

A VPN kill switch is essential for torrenting or any form of file-sharing. Torrenting without a kill switch runs the risk of your real IP address being exposed to your ISP, copyright trolls, and content owners.

If your VPN connection drops, even for a second, then your online identity will be visible to everyone in the torrent swarm.

If your VPN kill switch isn’t working then there’s usually an issue with the VPN service, your device, or both.

Faulty or outdated VPN software can prevent your kill switch from triggering during an unexpected VPN disconnection.

Even some top-rated providers, such as ExpressVPN and PrivateVPN, do not protect your traffic when switching VPN servers.

Equally, your device’s firewall or system settings may prevent the VPN client itself from functioning properly.

We’ve outlined some possible solutions for both types of faults below:

1. Change the VPN Protocol

Every VPN service functions differently depending on the protocol in use. This can include variations in the number of servers, advanced tunneling features, and the availability of a kill switch.

If your kill switch isn’t working, it may be due to the VPN protocol you’re using. Either the current protocol doesn’t support a kill switch or its kill switch doesn’t work properly.

From our testing, we found OpenVPN protocols to be the most compatible with a VPN kill switch – particularly OpenVPN TCP.

Some providers, such as Astrill and FastestVPN, only offer a VPN kill switch on OpenVPN protocols.

Try switching your VPN protocol to OpenVPN TCP and then test the kill switch again.

2. Run as Administrator

A VPN kill switch requires access to your device’s internet connection so that it can be disabled in the event of a VPN disconnection.

This is an intrusive action which could be blocked by your PC. If that’s the case, you will need to manually upgrade your VPN’s permissions.

Here’s how to upgrade your VPN’s privileges:

1. Navigate to the VPN’s app on your desktop.
2. Right-click the app and select Run as administrator.
3. A prompt will appear asking if the app can make changes to your device.

   Click Yes.

4. The VPN should now have the necessary permissions to disable your internet connection.

3. Update and Restart the App

You may be using an older version of a VPN app that doesn’t support a VPN kill switch or has a bug in its software preventing the kill switch from working correctly.

To determine whether your app is outdated, go to the VPN’s website and find the VPN apps page. This is normally labeled VPN Apps, Apps, or Download.

From here make a note of the current version of the VPN software and see if it matches the app installed on your device.

By installing the latest version of the app any known technical bugs should now be fixed, including a faulty kill switch.

4. Change Your Firewall Settings

As mentioned previously, your computer’s firewall may prevent any VPN connections from being established.

Even if you’re able to initially connect to a VPN server, your firewall may prevent the kill switch from reestablishing the VPN connection. This would leave your real IP address exposed without you ever realizing.

To fix this go into your device’s settings and add the VPN client to the list of apps that are allowed to pass through the firewall.

5. Contact Customer Support

If none of the solutions above work, contact the VPN’s customer support.

The quality of support can vary by provider but most VPNs will have an email or ticket system to answer queries.

At the very least the support agent can eliminate the possibility that your VPN is at fault for any kill switch issues

The majority of VPNs are equipped with a working kill switch – this is the absolute minimum we expect when it comes to security. However, not all VPN kill switches are effective or reliable.

We’ve tested dozens of VPN services to find the best VPN kill switches. Our criteria takes into account the number of compatible platforms, whether the kill switch can be turned on and off, and the level of kill switch customization available.

Every VPN we recommend on this page consistently passes our regular kill switch testing. That means the kill switch always activates immediately following a VPN disconnection and our real IP address does not leak.

We also expect the best VPNs to include an option for a permanent kill switch. This means your internet traffic is permanently blocked from leaving your device, even if your VPN client is turned off. You won’t be able to connect to the internet unless the VPN connection is reestablished first.

Here’s a table outlining the VPN kill switches that performed best in our testing: