A VPN encrypts your traffic only while the tunnel is up. Wi-Fi drops, your laptop wakes from sleep, the server reboots: for a second or two your apps keep talking, but now they talk directly over the open network. A kill switch closes that gap by blocking every packet that is not going through the tunnel.
How a kill switch works
The app watches the state of the VPN interface. When the tunnel is healthy, traffic flows as usual. When the tunnel goes down, the app installs a firewall rule that drops everything except the VPN handshake itself, then removes the rule once the connection is back.
Two kinds of kill switch
- System-level. Blocks all traffic on the device. This is what Atomic VPN does on Windows and macOS.
- App-level. Only closes the apps you pick. Useful for a torrent client, weaker for everything else.
When it actually saves you
Most of the time nothing happens. The kill switch earns its place in the few seconds when the tunnel is not there:
- Switching from Wi-Fi to mobile data on a phone.
- Laptop waking from sleep in a cafe.
- Server maintenance or a rare reconnect.
Without a kill switch, a one-second reconnect is enough for your real IP to reach the site you are on.
Kill switch vs. always-on VPN
| Feature | Kill switch | Always-on |
|---|---|---|
| What it does | Blocks traffic when the tunnel drops | Reconnects the tunnel automatically |
| Protects during reconnect | Yes | No |
| Needs the app running | Yes | Yes |
| Available in Atomic VPN | Yes | Yes |
You want both. Always-on brings the tunnel back, the kill switch makes sure nothing leaks while it does.
How to turn it on in Atomic VPN
Open Settings → Connection and enable Kill switch. On Windows the app adds a WFP filter, on macOS it uses the network extension, so no extra permissions are needed beyond the VPN profile you already approved.
Checking that it works
Disconnect your Wi-Fi for a moment while a page is loading. With the kill switch on, the page stalls until the tunnel is back instead of loading over the open network.
Takeaway
If you use a VPN for privacy rather than only for a different location, keep the kill switch on. It costs nothing in speed and closes the one gap encryption alone cannot.
