Kill switches and split tunneling explained

October 5, 2026 · 3D PrintMargin editorial · Educational guide

A kill switch and split tunneling answer different questions. A kill switch controls what happens when the protected connection is unavailable. Split tunneling controls which connections go through the VPN in the first place.

Understand a kill switch

A standard kill switch is designed to block traffic that would otherwise escape after an unexpected VPN disconnection. Some providers also offer an always-on or advanced mode that blocks connectivity whenever the VPN is disconnected, including intentional disconnections. Read the exact behaviour for your app before enabling it.

Understand split tunneling

Split tunneling can include selected apps in the VPN or exclude selected apps from it. Excluded traffic uses the ordinary connection and does not receive the VPN tunnel’s protection. That may be useful for compatibility, but it is a choice about traffic routing, not extra security for every app.

Check the combination on your device

Do not assume the controls work together identically everywhere. Proton’s current documentation says Windows supports combining its kill switch and split tunneling, while most other supported platforms have restrictions. Consult the current page for your operating system and app version.

Choose a simple starting configuration

For a first setup, route your intended traffic through the VPN and learn the kill-switch behaviour before adding exceptions. If you introduce split tunneling, list the apps that should be protected and those that should be excluded. Check each one after reconnecting.

Keep a recovery plan

An advanced kill switch can make a deliberate disconnection look like a broken internet connection. Know where the setting is and how to restore normal access. Test with a non-sensitive task before relying on it during an important upload or customer call.