Everyday Privacy

What Is a VPN Kill Switch and Do You Need One?

A VPN connection can drop without warning. When it does, your device quietly falls back to your normal connection and your real IP address is exposed. A kill switch prevents that.

Last updated October 18, 2026 · By Harbor Privacy

What a Kill Switch Does

It watches the VPN tunnel and blocks all internet traffic if the tunnel goes down, until the VPN reconnects. Nothing leaves your device outside the tunnel in the gap.

When It Matters

  • Moving between Wi-Fi and cellular, where the tunnel often briefly drops.
  • Weak signal that causes disconnects.
  • Torrenting, or any use where exposing your real IP is a problem.
  • Travel or public Wi-Fi where you rely on the VPN continuously.

For casual browsing at home, a short drop is lower risk.

How to Get the Same Protection

01
AndroidIn Settings, VPN, choose your VPN, then turn on Always-on VPN and Block connections without VPN.
02
iPhoneiOS has no system kill switch. In the WireGuard app, set On-Demand Activation so the tunnel reconnects automatically.
03
Windows and MacUse a VPN client with a kill switch setting, or a firewall rule that blocks traffic outside the tunnel.
04
RouterRun the VPN on the router and block traffic when the tunnel is down.

What It Does Not Fix

A kill switch stops leaks from a dropped tunnel. It does not fix DNS overrides or an app that talks outside the VPN on purpose. See DNS leaks.

Related guides: Set up a VPN on iPhone, DNS leaks, VPN won't connect.

Common Questions

Does every VPN have a kill switch?
No. Many apps include one, but built-in and standard WireGuard setups may rely on system settings instead.
Is Always-on VPN the same as a kill switch?
On Android, Always-on VPN with Block connections without VPN works as one.
Does iPhone have a kill switch?
Not at the system level. On-Demand Activation restarts the tunnel, though a very short gap is possible.
Will a kill switch cut my internet?
Only while the VPN is down. It reconnects when the tunnel is back.
Do I need one on public Wi-Fi?
It is a good idea, since a drop would expose your traffic on a network you do not control.
TRY HARBOR VPN

WireGuard with On-Demand support, one key per device, and threat-blocking DNS. See Harbor VPN.

Harbor Privacy
Cut Big Tech out of your home network.

Encrypted DNS and network-level blocking of trackers and ads on every device, set up in minutes. No technical skills required.

See plans →