5 min read
A kill switch is a rule that blocks all internet traffic the moment your VPN tunnel drops. Without it, a two-second disconnect means your device quietly falls back to the ordinary connection: apps reconnect, your messenger flushes its queue, the browser finishes loading the page — all of it in the clear, with your real IP address. A kill switch turns an outage into no connection at all, which is the point.
Tunnels drop for boring reasons: you walk from Wi-Fi to mobile data, an elevator eats the signal, the router reboots, a server gets busy. Your VPN client starts reconnecting, but the operating system doesn't know that — it just sees a working network interface and keeps handing traffic to apps.
In two to five seconds, this is what gets out:
That gap is where the whole arrangement fails. The tunnel itself can be flawless, but protection that only works when everything is fine isn't protection.
| Where it lives | How it works | How reliable |
|---|---|---|
| In the operating system | the OS refuses network access to every app outside the tunnel | higher: the rule holds even if the VPN client crashes |
| Inside the VPN app | the client closes connections when it detects a drop | depends on the client still running |
Practical rule: if your system can block non-VPN traffic itself, turn that on, and treat the app's own feature as a second line rather than the only one.
Android has a system-level setting that many people never find:
After that the system won't release a single packet until the tunnel is up. Menu names vary slightly between manufacturers, but the location is the same. Setting up the client itself: how to set up a VPN on Android.
One side effect to expect: until the tunnel connects, you have no internet at all. On networks with a sign-in page — hotel, airport, café — that captive portal won't load, so you'll need to switch the setting off briefly.
iOS has no separate "block connections without VPN" toggle. The app implements the behaviour itself: the tunnel extension stays active and refuses to pass traffic until the connection is restored.
In BessyConnect this is stated plainly — if the connection breaks, your internet simply stops working until protection comes back. iOS can also bring the tunnel up automatically when a network appears, and traffic isn't released before that rule fires.
This is the only check that shows what happens during a failure, which is the moment that matters:
Working: the page doesn't load and the video stalls — traffic is blocked until the tunnel returns. Not working: the page loads and shows your real address.
The rest of the connection checks are collected here: how to check your VPN is working.
It depends on what a leak costs you.
What's visible during a leak is covered here: does a VPN make you anonymous.
The kill switch is built into the app for Apple devices: if the connection drops, internet access stops until the tunnel is back. Automatic reconnection covers the common case — in most network changes the pause lasts seconds and you never notice it. On Android, layer the system-level "block connections without VPN" setting on top; it survives even if the app itself is killed by the battery manager.
What is a VPN kill switch in plain terms? A rule that cuts your internet if the VPN drops. Apps get no network until the tunnel is restored, so nothing goes out unprotected.
Does the iPhone have a kill switch? There's no system toggle, but the VPN app implements it. In BessyConnect, traffic stops when the connection breaks.
How do I enable it on Android? Settings → Network & internet → VPN → gear icon → Always-on VPN and Block connections without VPN.
Does a kill switch slow down my connection? No. It's a filtering rule, not extra processing — while the tunnel works, it does nothing at all.
Why can't I sign in to café Wi-Fi with the kill switch on? Guest networks authenticate you on their own page, which sits outside the tunnel. Turn the block off, sign in, turn it back on.
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
WhatsApp alternatives for video calls in 2025: Zoom, Teams, Signal and FaceTime instead of WhatsApp & Telegram — and how to bypass blocks with BessyConnect. More
BessyConnect logs policy explained: what any VPN service technically sees, which of it we store and do not store, and five ways to check it for yourself. More
