A VPN kill switch is a safety feature that blocks your internet connection, or closes chosen apps, the moment your VPN connection drops, so nothing travels outside the encrypted tunnel. Without one, your device quietly falls back to your normal connection, and your real IP address and traffic are exposed until the VPN reconnects. Most good VPN apps have one, but several leave it off by default, so check your settings. Split tunneling is the opposite idea: it lets you choose apps that skip the VPN on purpose.
Last updated 31 October 2026.
How a VPN kill switch works
Your VPN app keeps watching the connection to its server. NordVPN describes the steps on its kill switch page: the feature “continuously observes your connection to a VPN server,” detects the moment that connection drops, blocks some or all apps from reaching the internet, then restores access once the tunnel is back.
Why would a VPN drop at all? Usually it’s not the VPN company’s fault. NordVPN lists weak Wi-Fi, timeouts, and “continually switching between mobile internet and Wi-Fi hotspots,” as well as firewalls or antivirus software that block the app. When you close a laptop on a train and open it on hotel Wi-Fi, there’s a short window where the VPN is reconnecting and your device is already online. That window is exactly what a kill switch closes, and when you’re on a network you don’t trust, it’s the window that matters.
ExpressVPN makes the same point on its kill switch page: auto-reconnect is common, “but you may still experience small bursts of unprotected data.” A kill switch blocks unencrypted traffic “even before auto-reconnect kicks in.”
App kill switch vs internet (system-wide) kill switch
There are two kinds, and the difference matters.
| Type | What it does when the VPN drops | Trade-off |
|---|---|---|
| App kill switch | Closes only the apps you’ve chosen | The rest of your device stays online, unprotected |
| Internet (system-wide) kill switch | Blocks all internet traffic on the device | Safer, but cuts you off every time the VPN hiccups |
NordVPN’s help centre defines both. The Internet Kill Switch “cuts off your internet connection when disconnected from NordVPN servers.” The App Kill Switch “shuts down specified programs if you lose a VPN connection.” Its feature page says a system-level kill switch “is more secure than an application-level kill switch, but it can lead to frequent hang ups while browsing if you’ve got a spotty internet connection.”
Surfshark goes system-wide on purpose. Its kill switch page says “both of Surfshark’s kill switch modes work on a system level”: a soft mode that only kicks in when the VPN drops unexpectedly, and a strict mode that “blocks internet access anytime the VPN is off,” even after you disconnect manually. Proton VPN has a similar pair, Standard and Advanced, and ExpressVPN offers “Enable at all times” for the same stricter behaviour.
Honestly, for most people the system-wide version is the one to pick. An app kill switch protects only what you remembered to list, and most people miss at least one app that talks to the internet in the background.
How to turn on a VPN kill switch
Menu names change between app versions, so treat these as a guide and check your app. Each is taken from the provider’s own help or feature page, read today.
NordVPN. NordVPN says its Kill Switch “is not activated by default” on Windows, Android, macOS and Linux; you turn it on in the app’s settings. The Windows app lets you choose between the Internet Kill Switch and the App Kill Switch. On Linux, type nordvpn set killswitch on in a terminal. On Android 8.0 or later it works system-wide, and NordVPN also points to Android’s own Always-on VPN switch under Settings > Connections > More connection settings > VPN (the path varies by phone). On iOS and the App Store version for macOS, the equivalent is called “VPN bypass prevention,” under Settings > VPN connection. Our NordVPN review covers the rest of the app.
Proton VPN. Proton’s kill switch guide gives these steps for Windows: open Proton VPN, select Kill switch from the right side bar, turn on the Kill switch toggle, and click Apply. Standard is selected by default; click Advanced for the stricter mode, which “only allows internet access when connected to Proton VPN, no exceptions.” On iPhone and iPad, go to Settings > Security Options and enable the Kill switch toggle. On Android, Proton uses the phone’s built-in setting: find Proton VPN, tap the gear icon, and enable Always-on VPN and Block connections without VPN.
Surfshark. Surfshark’s instructions are short: go to Settings, then VPN settings, and turn the kill switch on. Then choose soft or strict mode. If you’ve never opened that menu, it takes under a minute.
ExpressVPN. Here you may not need to do anything. ExpressVPN says its Internet Kill Switch “is enabled by default” in its Windows, macOS and Linux apps, and on iOS it “is always on and can’t be disabled.”
Once it’s on, test it. NordVPN suggests turning it on and briefly disconnecting the VPN: “your internet should pause until it reconnects.” If pages still load, the kill switch isn’t doing its job. Don’t skip this test; it’s the only way to know the setting actually stuck.
What is split tunneling?
Split tunneling lets some of your traffic go through the VPN and the rest go through your normal connection. Surfshark’s split tunneling page describes it as dividing “online traffic between direct internet access and an encrypted VPN tunnel.” Most apps offer two modes:
- Exclude mode: everything uses the VPN except the apps or sites you list.
- Include mode (also called inverse or reverse): only the apps or sites you list use the VPN.
The providers name it differently. Surfshark calls it Bypasser, under Settings > VPN Settings > Bypasser. Proton VPN calls it split tunneling, on paid plans only, with a shortcut on the Windows home screen. NordVPN says its split tunneling is available on Android, Android TV and Windows, plus website exclusions in its browser extensions. On Linux, NordVPN offers an Allowlist of ports and subnets instead.
When split tunneling makes sense
A printer or other device at home. NordVPN notes that VPN encryption “may sometimes stop your device from connecting to other devices on your local home network.” Excluding the printer’s app, or your local network, lets you print without switching the VPN off.
A banking app that blocks VPN addresses. Some banks treat VPN server addresses as suspicious. NordVPN says plainly that “some banking apps” block VPN traffic, so you have to turn the VPN off to use them. Its help centre gives banking apps as the classic case for split tunneling, letting them “use your local IP address” while everything else stays in the tunnel.
Remote work. Surfshark points to remote workers who want to reach a company network securely “while keeping personal traffic on a regular connection.”
Speed for one heavy task. If a large file upload crawls through the VPN, excluding that one app can help. Our guide on whether a VPN slows down your internet explains why the server you pick usually matters more.
The risks of split tunneling
Every app you exclude is an app the VPN no longer protects. When you add one, you’re making a trade, not flipping a harmless switch. NordVPN puts it bluntly: “the split tunnel does not protect your traffic and does not change your IP address when using exempt apps.” Its advice is to keep unprotected apps “to a minimum.” Surfshark says the same: split tunneling “makes your data more vulnerable,” so only use it “with reputable apps and websites.”
In practice, the risk is greatest on public Wi-Fi. If you’ve excluded your browser at home to reach a local site and then forget about it on airport Wi-Fi, that browser is back on an untrusted network with no VPN at all. Don’t forget to review your exclusions when you travel.
There are platform quirks too. Proton notes that on macOS, split tunneling “doesn’t currently work with WebKit-based apps,” including Safari, so an excluded Safari may still use the VPN.
When the kill switch and split tunneling clash
Turn both on and you may find your excluded apps have no internet at all. That isn’t a bug. NordVPN’s help article on how the two interact says the Internet Kill Switch “takes absolute authority, and it cannot be bypassed by other settings.” So “even apps excluded from the VPN through Split Tunneling will be blocked by the Kill Switch when you are connected to the VPN.”
Its recommendation surprised us, coming from a security company: “For most users, especially when using Split Tunneling, relying on auto-reconnect provides a smoother experience without Kill Switch interruptions. Enable Kill Switch only if you require strict ‘no-traffic-unless-VPN-connected’ protection.”
Other providers handle it differently. Proton says that on most platforms its kill switch “is not compatible with split tunneling,” but on Windows you can use either kill switch mode with split tunneling. ExpressVPN says its Android kill switch blocks traffic when the VPN drops “while still allowing split tunneling.” Turns out there’s no single rule, so check your own provider’s page before relying on both.
A worked example: one laptop, two settings
Picture a freelancer called Alex working from a hotel for five nights. On the first night they turn on NordVPN’s Internet Kill Switch, because the hotel Wi-Fi drops every hour or so. On the second night they need to print an invoice on the hotel’s business-centre printer, so they exclude the printing app with split tunneling. It won’t connect. The kill switch is blocking it, exactly as NordVPN documents.
Alex has two sensible options. They can keep the kill switch and switch it off for the two minutes it takes to print, then switch it back on. Or, following NordVPN’s own note, they can drop the kill switch for the trip and rely on auto-reconnect. Given hourly drops on an untrusted network, keeping the kill switch is the safer choice. Skip the temptation to leave it off permanently just because one print job failed.
FAQ: kill switch and split tunneling questions
Should I turn on the VPN kill switch?
Yes, especially on public Wi-Fi or if you move between networks a lot. NordVPN’s own FAQ says to turn it on, because drops happen “more than you’d think.” The cost is that your internet pauses whenever the VPN reconnects.
Is a kill switch on by default?
It depends. NordVPN says its Kill Switch is disabled by default on Windows, Android, macOS and Linux. ExpressVPN says its kill switch is on by default on Windows, macOS and Linux, and always on in iOS. Check your app after installing.
Is split tunneling safe?
It’s safe if you use it sparingly. Excluded apps use your normal connection and your real IP address, so anyone watching the network can see that traffic. Exclude only trusted apps, and review the list before you join public Wi-Fi.
Why won’t my excluded apps connect?
Most likely your kill switch is blocking them. NordVPN says its Internet Kill Switch blocks excluded apps even while the VPN is connected. Turn off one of the two features, or check whether your provider supports both together on your platform.
The short version
- A kill switch blocks your connection when the VPN drops, so nothing leaks unprotected.
- A system-wide (internet) kill switch is safer than an app kill switch, which only closes the apps you list.
- Several apps leave the kill switch off by default; turn it on, then test it by disconnecting.
- Split tunneling sends chosen apps outside the VPN; useful for a home printer or a banking app, but those apps lose protection.
- The two can clash: on NordVPN the kill switch blocks excluded apps, so check how your provider handles both. For the wider picture, see what a VPN can and can’t hide.