A VPN protects your traffic only while the tunnel is up. Connections are not perfect: phones move between Wi-Fi and mobile data, hotel networks drop for a few seconds, laptops wake from sleep, servers restart. In those gaps, your device may quietly send traffic over your normal connection, and you would probably never notice.

A kill switch closes that gap. This guide explains what it does, how Android's built-in version works, what happens when your network changes, and the trade-offs that come with turning it on.

What a kill switch is

A kill switch is a rule that says: if the VPN isn't connected, don't let traffic out at all. Instead of falling back to your regular connection, apps simply wait until the tunnel is back.

Without a kill switch, a short drop can expose:

  • Your real IP address to the sites and apps you are using.
  • Your DNS lookups to your local network or provider, which reveals which sites you visit. Our guide to DNS leaks and encrypted DNS explains why that matters.
  • Unencrypted traffic from apps that don't use HTTPS properly, on a network you may not trust.

The name sounds dramatic, but the idea is simple: no tunnel, no traffic.

When the gaps happen

Most leaks don't happen while you sit still on a good connection. They happen at moments of change:

  • Switching networks, for example walking out of Wi-Fi range onto mobile data, or the reverse.
  • Weak or crowded networks, such as trains, airports and cafés, where the connection drops and reconnects.
  • Waking from sleep or restarting the device, before the VPN app has reconnected.
  • The VPN app itself restarting or updating.
  • A server or route going away, so the app has to find another one.

Each of these can last only seconds, but apps running in the background, such as messengers, email and sync, send data all the time.

Android's built-in kill switch: Always-on VPN

Android has the kill switch built into the system, so it works the same way for any VPN app that supports it.

According to the Android Developers documentation, Always-on VPN is available in Android 7.0 and later. Android can start the VPN service when the device boots and keep it running while the device is on. Always-on VPN can also block connections that don't use the VPN: with the "Block connections without VPN" switch on, the system blocks any network traffic that doesn't go through the VPN.

The documentation notes two more details:

  • From Android 8.0, when an always-on VPN disconnects or can't connect, you see a notification that can't be dismissed, so a failure doesn't go unnoticed.
  • When you turn on blocking, Settings warns you that you won't have an internet connection until the VPN connects.

How to turn it on for VPNRice

On Android, VPNRice uses this system feature as its kill switch. Open Android Settings, go to Network & internet, then VPN, tap the gear next to VPNRice, and turn on Always-on VPN and Block connections without VPN. Menu names vary a little between phone makers. On Android TV, the Always-on option is in the TV's network settings, if your device offers it. You can get the apps from the Android download page.

On iPhone and iPad, VPNRice has a kill switch in the app: open Account and turn it on, and iOS keeps traffic inside the tunnel while VPNRice reconnects.

The trade-offs

A kill switch is a deliberate choice of privacy over convenience. Expect these side effects:

  • No internet if the tunnel can't connect. If the VPN fails to connect on a particular network, you are offline until it does or until you turn the setting off. This is the point of the feature, but it can be surprising.
  • Captive portals. Hotel and airport sign-in pages often need you to connect before the VPN can start. You may need to turn off blocking briefly, sign in, and turn it back on.
  • Some apps lose their connection. The Android documentation warns that apps which bind to a specific network have no connection when traffic outside the VPN is blocked. The same applies to apps excluded from the VPN by split tunnelling.
  • Local devices. Printers, casting and other local-network features may stop working while everything is forced through the tunnel.

If you need a break from the rules, turn the kill switch off for a moment rather than uninstalling the VPN, and remember to turn it back on.

Kill switches on computers

On computers, kill-switch features usually come from the VPN app itself, and names vary: "kill switch", "network lock", "block traffic when disconnected". Check your app's settings, and test it.

Operating systems also have their own "always on" VPN profiles, and updates can break them: The Register reported on 20 October 2026 that a Windows 11 update bug left some Always On VPN connections stuck at "Connecting". If that sounds familiar, see VPN not connecting on Windows after an update? for what to check.

How to test your kill switch

  1. Connect the VPN and open What is my IP. Note that it shows the VPN server's address.
  2. Run the WebRTC leak test to make sure your browser doesn't expose another address.
  3. Simulate a drop: switch from Wi-Fi to mobile data, or turn airplane mode on and off.
  4. Reload the IP page immediately. With a working kill switch, the page either fails to load until the tunnel is back, or shows the VPN address again. It should never show your real address.

When you need one

Turn on a kill switch if you:

  • Use public or unreliable Wi-Fi regularly.
  • Move between networks often, for example commuting with a phone.
  • Want to be sure background apps never use your normal connection.

You may prefer to leave it off if you rely on captive portals all day, need local-network devices, or if a network blocks VPN connections, so blocking would leave you offline.

Key takeaways

  • A kill switch stops traffic whenever the VPN isn't connected.
  • On Android, it's the system's Always-on VPN with "Block connections without VPN".
  • Expect trade-offs: no internet if the tunnel fails, and issues with captive portals and local devices.
  • Test it by forcing a network change and checking your IP.