What is a VPN kill switch?
It is a rule that blocks all internet traffic the instant your VPN tunnel stops working. Its entire job happens in the few seconds between a tunnel dying and reconnecting — the window where your real IP would otherwise leak to whatever you had open.
Get LunoVPNWhat happens in the gap
VPN tunnels drop. Wi-Fi hands off between access points, a phone switches from Wi-Fi to mobile data, a server restarts, a laptop wakes from sleep. None of that is unusual.
When the tunnel dies, your operating system does the sensible thing: it falls back to the normal route. Your traffic keeps flowing, just unprotected. Nothing on screen changes — no error, no warning — because from the network stack's point of view everything is working.
In those seconds, anything with an open connection reconnects over the naked link. A torrent client announces to trackers from your real IP. A messaging app re-authenticates. A page you left open polls its API. Your ISP sees the destinations again, and the sites see your actual address and location.
The exposure is short but it is enough. A single tracker announcement or a single API call carrying your real IP is all it takes to break the association the VPN was maintaining. The kill switch exists so that instead of silently leaking, the connection simply stops.
Two implementations, very different strength
Application-level
The VPN client watches its own tunnel and, on failure, closes specified apps or blocks their traffic. Simple, but it depends on the client being alive. If the client crashes, the guard crashes with it.
Firewall-level
The client installs operating-system firewall rules that permit traffic only through the tunnel interface. If the tunnel is gone, the rules deny everything. This survives a client crash because the rules live in the OS, not the app.
Which to want
Firewall-level, every time. Ask a provider which one they ship — the marketing word is the same for both, and the difference only shows up on the day it matters.
Test yours in four minutes
A kill switch you have never tested is a claim, not a feature. This works on any provider.
Note your real IP first
Disconnect the VPN and open whatismyip on our site. Write the address down — this is the value that must never reappear.
Connect and confirm the change
Turn the VPN on, reload, and check the IP is different. Leave the page open.
Kill the tunnel abruptly
Do not use the Disconnect button — that is a graceful shutdown and tells you nothing. Instead force-quit the VPN process, or on a laptop pull the network and put it back. You want an ungraceful failure.
Reload immediately
If the kill switch works you get a browser error: no connection. If instead the page loads and shows your real IP, there is no protection in the gap.
Test with the app force-quit, not with the Disconnect button. A graceful disconnect lets the client tear down cleanly and re-enable traffic on purpose — exactly the scenario a kill switch is not for.
What a kill switch does and does not cover
| Scenario | Protected? |
|---|---|
| VPN server drops the connection | Yes |
| VPN client process crashes | Yes |
| Wi-Fi to mobile data handover | Yes |
| Laptop wakes from sleep | Yes |
| You press Disconnect yourself | No |
| DNS leaking outside the tunnel | No |
| WebRTC exposing your local IP | No |
| Being signed in to an account | No |
The three leaks a kill switch will not catch
A kill switch handles tunnel failure. These three happen while the tunnel is perfectly healthy, which is why they need separate checks.
DNS leaks. If your device keeps using the ISP's resolver instead of the VPN's, every domain you visit is still logged by your provider even though the traffic is encrypted. The tunnel is up, so the kill switch has nothing to react to.
WebRTC leaks. Browsers can expose your local and sometimes public IP through the WebRTC API, bypassing the tunnel entirely at the application layer. Again, nothing has failed — the browser is doing what it was designed to do.
IPv6 leaks. If the VPN only routes IPv4 and your network offers IPv6, traffic can escape over the v6 path. A well-built client either tunnels IPv6 or blocks it outright.
All three are worth testing once. They are silent by nature and none of them will ever trigger a warning.
Straight answers
Should I leave the kill switch on all the time?
Why does my internet stop working sometimes?
Does a kill switch hide my IP?
Do I need one on a phone?
Is a kill switch the same as always-on VPN?
A feature you hope never fires
LunoVPN ships a firewall-level kill switch on every platform, plus DNS handled inside the tunnel so the leak it cannot catch does not happen either.