What does a VPN kill switch actually stop when the connection drops?

Summary

A kill switch cuts off a device's internet access when the VPN connection drops, so apps can't carry on over the plain connection and reveal your real IP address or DNS lookups. Some kill switches only react to an unexpected drop, while others block everything whenever the VPN isn't connected, including after you disconnect on purpose. On company laptops and phones the question that matters is whether an administrator can lock the setting on, because an employee can otherwise switch it off.

Why a dropped VPN leaks

While the VPN is up, traffic goes through the tunnel. If the Wi-Fi hiccups or the VPN app crashes, the tunnel goes away but the device still has its normal route to the internet. Unless something intervenes, apps just keep talking over that route.

That's the gap a kill switch closes. Proton VPN's version blocks all internet traffic on the device "until you're reconnected," and Proton says the point is to protect your IP address and DNS activity.

Two very different triggers

Proton offers two kinds, and the difference is when they fire.

Standard kicks in only when the connection drops by accident. If you disconnect deliberately, your internet keeps working.

Advanced only allows internet access while you're connected to Proton VPN, "no exceptions," and it stays on through a restart. It's available on Windows, the Linux GUI app, and iOS and iPadOS in beta.

Mullvad's desktop app takes a different approach again. Its built-in kill switch blocks the internet while the app is still connecting at startup, when the connection fails, when your account runs out of time mid-session, and when the device loses its connection. Disconnect or quit on purpose, though, and your traffic goes out unprotected, unless you've turned on a separate setting called Lockdown mode.

What stops working while it's active

Blocking everything has side effects. Proton notes that with the kill switch on, macOS and iOS devices can't reach other devices on the local network. NordLayer says its kill switch may limit AirDrop, CarPlay and other device-to-device connections.

It also tends to clash with split tunneling, where some apps deliberately bypass the VPN. Proton supports the two together only on Windows.

Proton is open about two gaps on Apple devices. On macOS, your real IP may be exposed briefly while switching servers. On macOS and iOS, some DNS requests from Apple services can bypass the VPN even with the kill switch on.

On company devices, can IT lock it on?

A kill switch the employee can switch off doesn't do much for a company. What you want to know is whether the setting can be enforced centrally.

NordLayer: admins and members can each enable it on their own devices. On Windows, admins can also use presets to enforce it for every member of the organization. The help page describes no such enforcement for macOS, Android, iOS or Linux.
Android devices managed by the company: the management app can make a chosen VPN app always-on, and with lockdown enabled, traffic "can't leak to the open Internet" if the VPN disconnects. The VPN reconnects by itself after a reboot. Android's documentation warns that with lockdown off, traffic may be unprotected between boot and the moment the VPN connects. Separate restrictions stop users from changing VPN settings or uninstalling the VPN app.
iPhone and iPad: Apple's Always-on VPN configuration, for iOS 27 and iPadOS 27, routes all of a device's IP traffic through an IKEv2 tunnel that stays connected. It doesn't require supervision, and the admin decides whether users get a toggle to turn it off.

Sources

Related on this site

Written by Kaz (pen name). Published September 28, 2026. The facts above come from the vendor and standards pages listed under Sources. We have not used these products. Corrections: contact form.