What a VPN kill switch actually does (and when to turn it on)

A VPN kill switch blocks protected traffic if your VPN drops. Here is what that means for IP leaks, when to leave it on, and how it works with BetterVPN split tunneling.

A VPN session can drop when networks change: Wi-Fi cuts out, a laptop moves between access points, a phone switches to mobile data, or an app reconnects in the background. When that happens, your device may try to keep sending traffic as usual. Without a kill switch, that traffic could go out over your regular connection until the VPN reconnects.

Tunnel drop vs IP leak

To understand a kill switch, it helps to separate two related ideas: a tunnel drop and an IP leak.

A tunnel drop is the event. It means the encrypted VPN connection between your device and the VPN server stops working, even if only for a moment.

An IP leak is the result you want to avoid. If the tunnel drops and your device continues sending traffic over your normal internet connection, websites and services may see your regular IP address instead of the VPN IP.

That can happen during very ordinary situations, including:

• unstable public Wi-Fi
• switching between Wi-Fi and cellular data
• waking a laptop from sleep
• changing networks at home or at work
• temporary server or local connection interruptions

A kill switch is designed to reduce the chance that the second problem happens after the first one.

In practical terms, a kill switch tells your device: if the VPN is supposed to be active, do not allow protected traffic to leave outside the tunnel when the tunnel is unavailable.

This does not mean your internet is broken. It means traffic is being paused or blocked until the secure connection is restored, or until you manually disconnect the VPN.

What a kill switch actually does

The goal is simple: block network traffic that should stay inside the VPN if the VPN stops being available.

When enabled, a kill switch can help in moments like these:

• You connect to airport Wi-Fi, start browsing, and the hotspot briefly drops.
• Your phone moves from coffee shop Wi-Fi back to mobile data.
• Your computer goes to sleep and wakes up before the VPN session is fully re-established.
• A temporary network interruption causes the VPN tunnel to disconnect.

Without a kill switch, apps may continue communicating immediately over your normal connection. With a kill switch, those apps are less likely to send traffic until the VPN is back.

That matters for both privacy and consistency. If you expect a service to see the VPN IP, an accidental reconnect outside the tunnel can expose your regular IP, create inconsistent logins, or trigger extra verification checks.

Who should leave it on by default

For many people, leaving the kill switch on by default is the simplest choice.

It is especially useful if you:

• use public Wi-Fi often
• work on the go from hotels, airports, cafes, or coworking spaces
• want your traffic to stay inside the VPN whenever the VPN is connected
• care about avoiding accidental IP exposure during reconnections
• run background apps that may keep talking to the internet even when you are not actively using them

A kill switch is also a good default for people who do not want to constantly think about connection changes. Laptops and phones move between networks all the time. If you expect your VPN to stay in place during those transitions, keeping the kill switch enabled adds an extra layer of protection against brief dropouts.

When you might turn it off

There are situations where some users prefer not to use a kill switch all the time.

For example, if you are troubleshooting a local network issue, installing software that needs direct connectivity, or doing something time-sensitive where a temporary pause in traffic would be disruptive, you may choose to turn it off briefly.

Some people also prefer a more flexible setup on trusted home networks. They still use the VPN regularly, but do not want internet access to pause if the tunnel drops for a second.

That said, turning it off means accepting the possibility that some traffic could leave outside the VPN during a disconnect or reconnect event. It is a convenience tradeoff.

A reasonable approach is:

• keep it on for travel and public Wi-Fi
• keep it on if stable VPN coverage matters to you
• turn it off temporarily only when you understand the tradeoff and have a clear reason

How BetterVPN split tunneling works with it

BetterVPN includes split tunneling options, which gives you more control over what uses the VPN tunnel and what does not.

Depending on your device, BetterVPN supports split tunneling by country, app, and site or IP. This lets you decide which traffic should go through the VPN and which traffic should use your regular connection.

That is where people sometimes get confused about the kill switch.

A kill switch is meant to protect traffic that is supposed to be going through the VPN. Split tunneling, on the other hand, intentionally defines exceptions.

Here is the distinction:

• Kill switch: helps stop protected traffic from escaping outside the tunnel if the tunnel drops.
• Split tunneling: defines what should use the tunnel and what should not.

Here are a few examples.

Example 1: Browser in the VPN, local app outside it

If you route your browser through the VPN but leave a local printer utility outside the tunnel, the kill switch is relevant to the browser traffic, not the traffic you deliberately excluded.

Example 2: Certain sites through the VPN

If you use site or IP-based split tunneling, only the traffic you selected for VPN use is expected to stay inside the tunnel. The kill switch helps protect that expected path if the connection drops.

Example 3: Work app through the VPN, everything else direct

If you only route a specific app through BetterVPN, the kill switch helps prevent that app from falling back outside the VPN during a tunnel interruption. Other traffic that you intentionally left outside the tunnel is governed by your split tunneling rules.

This is why split tunneling and a kill switch are not opposites. They solve different problems. Split tunneling helps you choose the path. A kill switch helps enforce the protected path when the VPN is meant to be active.

A good habit: test your setup once

Whatever settings you choose, it is worth testing them once so you know how your device behaves.

You do not need to do this every day, but a quick check can be reassuring. Connect to the VPN, confirm your visible IP changes, then simulate a reconnect scenario by switching networks or briefly disconnecting and reconnecting the VPN. If you want a step-by-step checklist, see our guide on how to test if your VPN is actually working.

You mainly want to confirm that your setup behaves the way you expect.

Summary

A VPN kill switch is a safety feature. It helps reduce accidental exposure if your VPN tunnel drops by blocking traffic that should remain inside the VPN until the connection returns.

For most people, especially on public Wi-Fi or mobile devices that change networks often, leaving it on is a smart default. If you use split tunneling, think of the kill switch as protection for the traffic that is meant to stay in the tunnel, while your split tunneling rules define intentional exceptions.

If you want to try BetterVPN on your devices, download the app here:

Get BetterVPN

BetterVPN is available on iPhone, iPad, Android, Windows, macOS, Apple TV, and Android TV, with one subscription covering your devices.