Why a VPN kill switch should fail closed
Author
EVPN Research
Date
August 2, 2026
Reading Time
6 min read
If the tunnel dies and traffic continues, the UI lied.
Kill switches are often marketed as a checkbox. The important question is behavioural: when the VPN path fails, does the device fail closed or fail open?
Fail open
Fail-open behaviour restores general internet access when the tunnel drops. Convenience wins. Protection silently ends.
For users who enabled a VPN specifically to avoid leaking on untrusted networks, fail-open is a contradiction.
Fail closed
Fail-closed behaviour blocks traffic that would leave outside the tunnel while protection is supposed to be active.
Trade-off: you may lose connectivity until the tunnel recovers or you intentionally disable protection. That is usually the correct trade for a privacy product.
EVPN’s Leak Shield is designed around this fail-closed idea for DNS, IPv6 and application traffic where the platform allows enforcement.
Platform reality
Not every OS exposes the same hooks. Mobile background states, per-app VPNs and captive portals complicate enforcement. A serious product documents platform differences instead of pretending one mythic switch works identically everywhere.
What users should demand
- Clear language: protected vs not protected
- Explicit behaviour on drop, sleep and network change
- IPv6 included in the same policy
- No silent fallback to the physical interface while “protection” remains enabled
Closing
A kill switch that fails open is a reconnect helper. A kill switch that fails closed is a privacy control. EVPN is being designed for the second definition — and will describe platform limits as apps ship, not after users discover them the hard way.
