Android VPN Kill Switch: How to Turn On the One Built Into Android

Android has a VPN kill switch built into the operating system, and it's better than most people realise. It lives in Settings under VPN, as two options: Always-on VPN and Block connections without VPN. Turn both on for your VPN app and the phone will refuse to pass any traffic unless the tunnel is up — even if the app crashes or the connection drops. It works independently of any kill switch inside the VPN app itself, which is exactly why it's worth using.

What a kill switch does, and why it matters on a phone

A kill switch stops your traffic from leaking onto the open network if the VPN connection fails. Phones make this genuinely useful because they drop and switch connections constantly — walking out of Wi-Fi range, moving between cell towers, coming off airplane mode. Each of those is a moment where, without a kill switch, an app might fire off a request over the naked connection before the VPN reconnects. On Android, the system-level kill switch closes that gap at the operating-system level, which is more reliable than trusting the app alone to catch every transition.

Where to find it on Android

The exact path varies slightly by manufacturer, but on stock Android 8 and later it's roughly the same. Open Settings, go to Network & internet (or Connections on some phones), then VPN. Tap the gear or settings icon next to your VPN app's entry, and you'll see Always-on VPN and Block connections without VPN. You may need to connect the VPN app once first so it appears in the list. Note that some phones only let you enable Always-on for apps that support it, and the block option is greyed out until Always-on is on.

1. Open Settings, then Network & internet (or Connections), then VPN.
2. Tap the gear icon next to your VPN app.
3. Turn on Always-on VPN, then turn on Block connections without VPN.

System kill switch vs the app's own kill switch

Many VPN apps include their own kill switch as well, and it's fair to ask whether you need both. The system-level toggle is the more robust of the two because it's enforced by Android itself rather than by the app — if the app process dies, the OS still blocks traffic. The app's own kill switch can add finer control, such as excluding specific apps, and it works the same on every phone regardless of manufacturer menus. Using the system option is the belt-and-braces choice; if you only enable one, make it the OS one. Just know that turning on Block connections without VPN means your phone genuinely will not load anything while the tunnel is down, which is the point.

How to test that it actually blocks

To check the kill switch works, connect the VPN, confirm you have internet, then force-stop or disconnect the VPN app while watching a live connection — for example, a page trying to load or a stream. With Block connections without VPN on, traffic should stall immediately rather than falling back to your normal connection. When you reconnect the VPN, it should resume. If pages keep loading with the VPN off, the block isn't active, so recheck that both Always-on and the block option are enabled for the right app.

The iPhone caveat

This is the one area where Android clearly beats iPhone: there's no equivalent system kill switch on iOS, which relies on Connect On Demand to reconnect instead of blocking. If a hard fail-closed setup matters to you, Android is the platform that supports it out of the box. Either way, pick a trustworthy app first — see our best VPNs for iPhone and Android — and if you're on iOS, our guide to always-on and on-demand on iPhone explains what you get instead.

When you might not want it on

A hard kill switch is exactly as blunt as it sounds, which is occasionally inconvenient. With Block connections without VPN enabled, your phone will not touch the internet when the tunnel is down — including in situations where you might want it to. Captive-portal Wi-Fi at hotels and airports is the classic headache: those sign-in pages need a brief unprotected connection to load, and a strict kill switch can stop them appearing, leaving you unable to get online at all. Some phones handle this better than others. If you hit that wall, the fix is to temporarily turn off Block connections without VPN, complete the portal sign-in, reconnect the VPN, then switch the block back on. It's a small tax for a fail-closed setup, and worth knowing about before you're stuck at a gate wondering why nothing loads.

Always-on and the app both matter

For the kill switch to be meaningful, the tunnel has to actually stay up, and on some phones aggressive power management works against that by closing backgrounded apps. If your VPN keeps dropping — which then triggers the block and leaves you with no internet — exclude the VPN app from battery optimisation in your phone's app settings, so the system stops killing it. It's also worth pairing the system kill switch with the app's own auto-connect, so the tunnel comes back promptly after any genuine drop. Together, Always-on VPN, Block connections without VPN, an unrestricted background app and a modern protocol give Android something an iPhone simply can't match out of the box: a setup that fails closed and recovers on its own.