Kill Switch

A kill switch is a traffic-control policy for a VPN. When a tunnel fails, ordinary routing may send traffic through the direct connection and expose its IP. Blocking that fallback requires effective rules for the intended apps and address families. HTTPS can still encrypt application content on a direct connection; it does not hide that connection’s source IP.

Blocking may apply to selected apps or the whole device, with exceptions for tunnel establishment and local services. Check the client’s documented behaviour during startup, reconnect, sleep and manual disconnect. DNS and IPv6 need their own checks; DNS-leak protection and a kill switch are related controls, not proof that every path is covered.

s4m supplies VPN profiles for compatible WireGuard and OpenVPN clients. Blocking outside the tunnel depends on the chosen client, operating system and effective policy. Enable its documented feature and test the relevant failures. The no-logs policy and RAM-first description concern other aspects of the service; neither establishes client-side leak protection.