Skip to contentVPN kill switch — block leaks if the tunnel drops
VPN kill switch setup and checks for Linux, macOS and Windows: client settings, firewall limits, DNS, IPv6 and failure testing.
What a kill switch does
A kill switch restricts traffic outside a VPN according to the client and firewall policy. Before setup, record the current routes, DNS and rules, keep local access, and prepare recovery to those settings. Enable the client’s documented blocking option; automatic reconnect alone is insufficient. The commands below inspect the machine without changing its policy. Use them to review IPv4, IPv6, the actual tunnel interface and existing exceptions before testing failures.
Linux (nftables)
Inspect routes and the existing nftables ruleset. For wg-quick, review the upstream kill-switch example and its lifecycle hooks; do not erase unrelated firewall rules or assume established direct connections are blocked.
ip -4 route show table all ip -6 route show table all sudo nft list ruleset
macOS (pf)
Inspect PF rules without loading a replacement or disabling PF. Interface names can change. Follow the chosen macOS VPN client’s blocking documentation; full-tunnel routing and automatic reconnect do not by themselves establish a kill switch.
sudo pfctl -sr netstat -rn -f inet netstat -rn -f inet6 scutil --dns
Windows (PowerShell, run as Admin)
These PowerShell commands only inspect policy and routes; they do not enable a kill switch. Review existing allow rules and their address, port and interface filters.
Get-NetFirewallProfile -PolicyStore ActiveStore | Select-Object Name,Enabled,DefaultOutboundAction Get-NetFirewallRule -PolicyStore ActiveStore -Enabled True -Direction Outbound | Select-Object DisplayName,Action,Profile Get-NetRoute -AddressFamily IPv4 Get-NetRoute -AddressFamily IPv6
Why block IPv6
Check IPv4, IPv6 and DNS separately. If the profile does not carry IPv6, verify that the client blocks it rather than assuming an IPv4 tunnel does so. Use the IP test as one observation, then test new and existing connections while the tunnel endpoint is unreachable, during reconnect and after sleep or reboot. Manual disconnect may deliberately restore ordinary access. Review wg-quick’s configuration and hooks before Linux setup, and use the Windows walkthrough for WireGuard’s client-specific settings. These inspection commands do not configure protection or prove leak-free operation.
Questions, answered
Do I really need a kill switch?
Enable blocking when you need traffic to stay inside the VPN, then verify its scope and exceptions. Test failed handshakes, reconnects, sleep, startup and manual disconnect with IPv4, IPv6 and DNS. A successful IP check alone does not prove all traffic is protected.
Will this survive a reboot?
Persistence depends on the client and policy. Verify protection before the tunnel connects after a reboot, during login and after an update. Automatic reconnect is not evidence of persistent blocking; keep a tested recovery plan for the original settings.
People found this page by searching for
- VPN kill switch
- what is VPN kill switch
- VPN kill switch settings
- scraping Amazon
- how VPN kill switch works
- free proxy list by country
- browser fingerprinting
- how to check if a proxy is anonymous
- how to check openvpn
- ip address tutorial
- http proxy subscription
- what is wireguard
Real search phrases this page answers — the linked ones open the page that covers them in depth.