What happens the second your VPN drops
Tunnels fail. A Wi-Fi handover, a server restart, a laptop waking from sleep — and for a few seconds your traffic quietly returns to your normal connection. A kill switch is what stops that from being silent.
On every platform, no account needed. The kill switch is on by default.
What a kill switch actually does
A kill switch watches the VPN tunnel and cuts network access the instant it stops being available. Nothing subtle happens: apps lose connectivity, pages stop loading, and that is exactly the point. The alternative is worse than an error message — it is a request leaving your machine with your real IP address attached, without anyone noticing.
The failure it protects against is almost never dramatic. It is a laptop lid closing, a phone switching from Wi-Fi to mobile data, a VPN server going down for maintenance. In each case the operating system does what it is designed to do: fall back to the working connection. Without a kill switch, that fallback is invisible and instant.
What happens in each scenario
These are the four moments a tunnel realistically breaks. The difference is not whether your connection recovers — it always does — but what leaves your machine while it recovers.
| Scenario | Without a kill switch | With SandVPN |
|---|---|---|
| Wi-Fi to mobile data | Traffic resumes on the carrier's network before the tunnel rebuilds | Network access is blocked until the tunnel is up again |
| Laptop wakes from sleep | Background apps sync over the raw connection within seconds | Nothing reaches the network before the VPN reconnects |
| Server restart or switch | A gap of a few seconds where requests go out unprotected | The gap is closed — traffic waits rather than leaking |
| VPN process crashes | Everything keeps working, which is exactly the problem | Connectivity stops, so the failure is obvious rather than silent |
How it works
- 01
It watches the tunnel
The client tracks the state of the encrypted connection continuously, not on a timer — so it notices a drop in the same moment it happens.
- 02
It blocks at the network layer
Traffic is stopped below the application level, which means every program on the machine is covered, including the ones that never asked about the VPN.
- 03
It restores by itself
As soon as the tunnel is re-established, access comes back without any action from you. In practice you notice a pause, not an outage.
When it actually saves you
Long downloads and P2P
Transfers that run for hours are the most exposed: they outlast Wi-Fi hiccups and sleep cycles, and they keep sending long after the tunnel has quietly gone.
Public and hotel Wi-Fi
Captive portals drop and re-authenticate connections constantly. Each of those cycles is a small window where your real address is visible on a network you do not control.
Anything you would not repeat out loud
If a single leaked request would matter — reporting, research, anything on a network under someone else's control — then a silent failure is not an acceptable failure mode.
Kill switch — frequently asked questions
Does a kill switch slow my connection?
No. It does not sit in the data path adding work; it watches the tunnel's state and acts only when that state changes. When everything is fine it costs nothing measurable.
Why does my internet stop when I close the VPN?
That is the kill switch doing its job: it cannot tell a deliberate quit from a crash, so it blocks either way. Disconnect from inside the app rather than force-quitting it, and access is released cleanly.
Do browser extensions have a kill switch?
Not in the same sense. An extension only routes what the browser sends, so it can stop the browser but not the rest of your machine. Full protection needs the desktop or mobile app, which works at the network layer.
Is a kill switch the same as DNS leak protection?
No, they cover different failures. A kill switch handles the tunnel going away entirely. DNS leak protection handles the tunnel being up while name lookups still travel to your provider. SandVPN does both.
Should I leave it on all the time?
Yes, unless a specific tool needs the local network while the VPN is down. Leaving it on is the whole point: the moment you would most want it is the moment you did not plan for.
Get the kill switch on your device
Free to start, no account needed. The kill switch is in every plan, including the free one.
Get SandVPN — freeOn every platform, no account needed. The kill switch is on by default.