Two kinds, and only one of them works
Reactive. The app notices the tunnel has dropped, then blocks traffic. Between the drop and the noticing — anywhere from a fraction of a second to several seconds — everything on the device is using your ordinary connection with your real address. If the app crashes rather than disconnecting cleanly, it never notices at all.
Firewall-level. The app installs rules in the operating system’s own firewall that permit traffic only through the tunnel interface. If the tunnel is down, nothing leaves, regardless of whether the VPN app is running, responding, or has crashed. This is the kind that works.
The names differ by provider: Private Internet Access calls it “always”; Mullvad has it on by default and does not let you turn it off while connected; Proton calls it a permanent kill switch; ExpressVPN calls it Network Lock; NordVPN has an internet kill switch alongside a per-app one. On Windows these use the Windows Filtering Platform; on macOS, packet filter rules; on Linux, nftables or iptables.
When the tunnel actually drops
More often than people expect, and rarely with any visible sign:
- A laptop waking from sleep reconnects to Wi-Fi before the VPN re-establishes.
- A phone moving between Wi-Fi and cellular.
- The operating system suspending the VPN app in the background.
- A server going down, or a protocol being blocked mid-session.
- The app crashing.
In each case a reactive switch has a gap and a firewall-level one does not.
Testing yours
The kill switch test on this site polls your address every 1.5 seconds and logs every change. Connect the VPN, start the monitor, then break the connection in whichever way matches how you actually use the device:
- Toggle Wi-Fi off and on — the most realistic, and what happens whenever you move.
- Switch from Wi-Fi to mobile data on a phone.
- Force-quit the VPN app — tests whether the switch survives a crash.
- On a laptop, close the lid for ten seconds.
A working switch shows the requests failing (“unreachable”) until the VPN is back, then the original address returning. Exposed time: zero. A failing one shows a different address — your real one — and the timer counts how long it was visible.
Why torrenting is the sharp case
A torrent client announces itself to a tracker so peers can find it, and it keeps doing so on whatever connection is available. Copyright monitoring firms sit in public swarms recording every address they see. A two-second gap is enough for one announce, and one announce is enough to become a settlement demand in Germany or the United States.
Two defences, and they stack. The firewall-level kill switch above, and binding the torrent client to the VPN’s network interface — in qBittorrent, Settings → Advanced → Network interface, then choose the VPN adapter. Once bound, the client cannot send a packet by any other route even if the VPN app is not running at all. Confirm with the torrent IP check, which shows the address your client actually announced.
What to do if yours fails the test
Look for a stricter mode in the app first — most providers have both a basic and a permanent option, and ship with the basic one. If there is no such mode, that is a real reason to change provider: the torrenting list scores this specifically, and every provider on it has a firewall-level switch.