VPN Kill Switch in Plain English: Connected Is Not Protecting

Fail-closed: the tunnel is the only allowed exit. If WireGuard or OpenVPN is not up, the client (or the OS, if you used a system lock) refuses the rest. Mail does not fetch. Maps do not tile. The browser sits on a timeout. That is success for the switch and misery for a splash page. Fail-open: the tunnel is a preference. If it dies, the default route wins. You keep scrolling. Your real IP shows up at the next site. You might not notice for a minute. That minute is the product the switch was invented to delete.

I will not claim Klox's row is ExpressVPN's Network Lock. Their name is theirs. Ours is whatever string your Settings screen actually prints. Open the app. Find the row. Turn it on if you want fail-closed. Leave it off if you would rather keep a route when the handshake sulks. Both are adult choices. Pretending Connected already meant fail-closed is how people leak on a flaky cafe radio and then file a ticket that says the VPN lied.

The rest of this page is the vocabulary around that paragraph. Connected versus protecting. The drop window if you skipped the switch. Why hotel gardens hate it. Why Android Always-on is a cousin, not a twin. Desktop versus phone. When leaving it off is the right call. How to test without a lab. If you already knew fail-closed, the table is enough. Most people I have watched did not know. They saw a green badge and assumed the NIC was in jail.

Connected answers: did the handshake finish? Is there a peer? Can this device send into WireGuard or OpenVPN right now? Protecting, if the client even uses that word, should answer: if that peer vanishes, will anything else leave? Those are different lights. Farms mash them because both are green and both sell a feeling.

I have watched people screenshot Connected and call it a kill switch test. It is not a test. A test is: pull the tunnel out from under the badge and see whether a site still loads on the real NIC. If it loads, you were connected and fail-open. If it dies, you were connected and fail-closed, or you lost the whole interface for some other reason. Losing Wi-Fi is not a kill switch. Losing the VPN adapter while Wi-Fi stays up is the interesting case.

Some UIs print Protecting as a synonym for Connected. That is copy, not physics. Read it like a billboard. Then open Settings. The row that actually closes the door is the one that mentions blocking, locking, or killing traffic when the VPN is down. If Klox's string is simply Kill switch, that is the row. If a build says something else, believe the glass, not this paragraph's wish.

The Why You Need a VPN Kill Switch article will tell you to turn it on. Fine. This page will tell you that turning it on is how Connected becomes a state that can survive a drop without donating an IP. Until the row is on, Connected is a rental. The landlord can leave.

Cafe radios drop. Hotel APs reboot. Laptops sleep and forget a peer. Mobile hops from Wi-Fi to cellular. None of that is exotic. Without fail-closed, each drop is a window where the default route is honest again. HTTPS still encrypts page bodies on TLS sites. RFC 8446 did not move. The cafe still gets destination IPs, often SNI, DNS if names are not inside some other encryption. Your ISP at home gets the same class of leftover. The window is not 'they read your password from the wire' on a modern bank. The window is 'they saw who you talked to, and the site saw your real IP.'

How long? Seconds if you notice. Minutes if a background tab keeps loading and you are talking. Hours if a download client does not care about your badge. Torrenting without a switch is the classic horror story and I will not rewrite it. Mail fetch is the boring version. Sync does not wait for you to feel unprotected.

Reconnect without a switch is a race. The client tries. The OS already sent packets. Winning the race sometimes is not a policy. The VPN Reconnect and Kill Switch: Stay Protected When the Connection Drops piece is the pairing. Here the plain-English remainder is: reconnect is an attempt. The switch is a gate. Buy the gate if the window bothers you. Live with the window if you would rather never fight a portal.

I will not quote an SLA for how fast Klox reconnects. There is no percentage on this page. Handshake time depends on the network, the protocol, and whether the splash page already hates you. WireGuard is usually the faster try. OpenVPN is the spare tire when UDP is rude. Neither is a switch.

A captive portal wants a clear HTTP hop so it can show a login, a voucher, an I agree, a room number. Your OS tries to detect that garden. A VPN that starts the instant the radio associates can steal the first hop. A kill switch that is already armed can then block the HTTP the portal still needs. Deadlock. Wi-Fi says connected. Nothing loads. No splash. You reboot. You blame the product. The product did what fail-closed means.

Order, the ugly one that works: join the SSID. If Smart Connect already fired, Disconnect. Pause the switch if traffic is still blocked. Complete the page. Confirm a boring site loads. Connect Klox. WireGuard first. Restore the switch if you still want it. You will be naked on that LAN for a minute. That is the cost of the garden. I will not claim zero exposure. I will claim this is normal.

The VPN on Cafe Wi-Fi: A Habit, Not a Superpower essay is the longer ritual. This section is only the collision: fail-closed and splash pages are not friends. If your travel week is nothing but hotels, leaving the switch off until after the portal is a strategy, not a character flaw. Forgetting the switch at home after the trip is a different mistake.

If there is no splash, you already have a route. Then waiting is how mail fetches on cafe DNS. Connect. Arm the switch if you want the drop to hurt instead of leak. Do not perform a portal ritual that is not there.

Android Always-on VPN is an OS policy: keep this VpnService up. Block connections without VPN is the stricter cousin: if that service is down, nothing else leaves. That second box is fail-closed implemented by Google, not by a Settings string inside Klox. It can deadlock a hotel the same way. It can also hold a device seat overnight because the tunnel never dies. The Android Always-On VPN: When to Use It article is the household version of that lock. This page will not clone it.

Desktop kill switch is usually the VPN app writing firewall rules. Phone Always-on is the OS watching the VPN app. You can have Always-on without the app's own kill-switch row. You can have the app row without Always-on. You can have both and then wonder why a splash page never appears. Count the locks. Do not assume one badge armed all of them.

iOS is ruder about what a third-party VPN may brick. Do not copy an Android lockdown screenshot onto an iPhone and call it the same product. Confirm the rows on the device in your hand. Five devices means five different Settings screens if you are the kind of person who mixes a Pixel, an iPhone, a Windows laptop, and a Mac. The plan is five. The physics are per OS.

I want Always-on on a travel phone whose owner knows the portal dance. I want the app kill switch on a laptop that lives in cafes. I do not want both on a kid tablet that has to join school Wi-Fi before breakfast. That is how dinner becomes a ticket.

A laptop kill switch is loud. Browsers timeout. Slack sulks. You notice because you were typing. A phone kill switch is quiet. The radio already flakes. You assume the cafe is bad. Background fetch fails and you find out when mail is empty at the gate. Same policy. Different UX. That is why people leave the phone switch off and keep the laptop one on. It is not hypocrisy. It is which failure they can see.

Desktop also has printers, NAS, local SSH, a game on the LAN. Fail-closed can brick those even when the WAN tunnel is fine, depending on how the client wrote the rules. If the app shows split tunneling, you might exclude a local target. If the row is missing, pause the tunnel for the printer job. Do not invent a per-IP bypass because a Features page mentioned split tunneling in the abstract. The glass is the source of truth.

Phone has cellular as a spare path. If Wi-Fi plus fail-closed is a brick, disable Wi-Fi and use the carrier. That is a valid travel move. It is also a second hop your carrier can see. A tunnel on cellular is still a tunnel. Fail-closed on cellular still bricks you if the handshake dies and you have no Wi-Fi left. Think before you arm both radios into a corner.

WireGuard first on both. OpenVPN when the path is rude. Protocol choice does not replace the switch. It changes how often the switch has to fire. A rude AP that kills UDP will fire it a lot. Switch protocol before you disable fail-closed as a personality.

Leave it off for the garden, then put it back. Leave it off on a week of hotels if you cannot be trusted to pause it ten times a day and you would rather a leak window than a brick. Leave it off on a desktop that must talk to a local license server you cannot exclude. Leave it off if the row exists but turning it on breaks every printer and you have already confirmed split tunnel is missing.

Do not leave it off because a ranked list said kill switches cause 'connection issues' as if that were a defect. Fail-closed is the issue. You bought the issue. Do not leave it off because the cafe felt slow once. Slow is protocol, server, or a tiny AP. Try OpenVPN. Move seats. Use cellular. Slowness is not an argument against a gate.

Do not leave it off on a laptop you torrent from, then ask support why an IP showed up. I will not coach torrenting. I will say the window is real. Do not leave it off and then claim the privacy policy failed you. /privacy is files. The switch is packets. Different drawers.

I still want it on for untrusted Wi-Fi after the splash. That is the default I will defend. Skipping the default is allowed when you can name the leftover. Forgetting the default is why Smart Connect exists, and Smart Connect is not a kill switch.

You do not need Wireshark. You need a site that shows an IP, a browser, and a way to drop the tunnel without dropping Wi-Fi. Connect Klox. Load the IP page. Note the VPN address. Disconnect in the app, or kill the client process if you are sure you know how. Reload. If you see your real IP and the page loads, fail-open. If the page hangs and nothing else works either, fail-closed, or you also killed the NIC. Reconnect. Confirm the VPN IP returns.

Do this on a network you control first. A home guest SSID is enough. Do not make a hotel lobby your first rehearsal. Do not test by turning Wi-Fi off. That tests whether you have cellular, not whether the switch works. Do not test by rebooting the router unless you like chaos.

If the row was off, turn it on, repeat. If the row is missing, you just measured fail-open. Live with it or write support. I will not paste iptables into a consumer blog so you can roleplay a switch we did not ship.

Leak tests after a healthy connect still matter: DNS, IPv6, WebRTC. Those are Features-page sentences and a different article. They answer 'is this session messy while up.' The kill switch answers 'is this session messy when down.' Run both if you are the kind of person who runs either. Then drink the coffee. Yearly from $2.83 a month does not include a lab technician. Five devices means you may want to test the laptop and the phone separately. They are not the same lock.