VPN Guides

Mullvad kill switch: how it works, how to enable it, and best practices

By Vita Holst · November 1, 2026 · 6 min

A practical guide to Mullvad VPN’s kill switch, its behavior, setup steps, and tips to stay secure online.

the article body in Markdown

Mullvad VPN is known for its strong privacy stance and straightforward security features. One of the most important protections you’ll want in place is a reliable kill switch. A kill switch prevents your device from sending traffic outside the VPN tunnel if your VPN connection drops. This is crucial to stop IP leaks and preserve your anonymity, even during momentary VPN failures. In this guide, you’ll learn how Mullvad’s kill switch works, how to enable it, how to test it, and best practices to keep your online activity private.

What a kill switch does and why it matters

Definition: A kill switch blocks network traffic when the VPN connection is not active, preventing data from leaking to your ISP or external networks.
Why it matters: Even brief VPN disconnects can reveal your real IP address, especially if you have apps that connect outside the tunnel.
How Mullvad implements it: Mullvad’s client includes a built-in mechanism to restrict traffic when the VPN interface is down or disrupted, aligning with the overall goal of preserving privacy.

Common leakage scenarios

DNS leaks: Without a VPN, DNS requests can reveal your queries to your DNS resolver.
IP leaks: Your device may use its real IP when the VPN disconnects.
WebRTC leaks: Some browsers can leak IPs via WebRTC. Using a VPN with proper settings helps reduce risk.
Application leaks: Some apps try to bypass VPNs or reconnect unless the kill switch is active.

How to enable and configure Mullvad’s kill switch

Mullvad makes it straightforward to enable the kill switch from its client, but there are nuances depending on your platform (Windows, macOS, Linux, iOS, Android). Here are the general steps and tips:

Install Mullvad: Ensure you’re using the latest Mullvad client from the official site.
Find kill switch settings: In most clients, look for a section labeled Privacy, Network, or Kill Switch.
Enable automatic block: Turn on the option to block all traffic if the VPN disconnects.
Tie to the VPN connection: Some settings allow tying the kill switch to the active Mullvad connection only or to all interfaces.
App-level control (where available): Some platforms let you specify which apps are protected by the kill switch or by the VPN tunnel.

Platform-specific notes

Windows: The Mullvad client typically exposes a clear toggle. Ensure you also allow Mullvad to manage your firewall rules if prompted.
macOS: The kill switch functionality is integrated and should apply to all network services when enabled.
Linux: Depending on your desktop environment, you may need to rely on Mullvad’s app or network manager integration. Check for any distro-specific caveats.
iOS and Android: Mobile clients provide kill switch options. Ensure the OS-level VPN settings are not overridden by other apps.

Testing the kill switch to confirm it works

Testing is essential to ensure the kill switch is active and effective. Here are reliable methods:

Disconnect test: While connected to Mullvad, force the VPN to drop (disconnect the client or disable the network interface) and observe whether your apps lose connectivity or the Mullvad client blocks traffic.
DNS leak test: After enabling the kill switch, perform a DNS leak test using a trusted site (for example, dnsleaktest.com). Confirm that DNS requests do not reveal your real location when the VPN is down.
IP leak test: Temporarily disconnect Mullvad, then perform an IP check on a site like ipinfo.io. You should see Mullvad’s server IP or no response, not your real IP.
WebRTC test: Use a WebRTC test site to ensure your real IP is not exposed when the VPN is disconnected and the kill switch is active.
Automated tests: Some advanced users run script-based tests to periodically verify the kill switch status, especially on servers or headless setups.

What to do if the kill switch isn’t working

Update the client: Ensure you’re on the latest Mullvad version, as updates fix bugs and improve security features.
Check firewall rules: On some systems, other firewall configurations can interfere with the kill switch behavior.
Restart Mullvad and the device: A clean start can resolve lingering network state issues.
Review VPN protocol: Certain protocols or configurations may interact differently with the kill switch. Consider using the default recommended protocol.
Contact support: If issues persist, Mullvad support can help troubleshoot specific platform quirks.

Comparing kill switch behavior across platforms and scenarios

A quick reference helps you understand how Mullvad’s kill switch behaves in common setups. The table below highlights typical expectations.

Platform	Default behavior when VPN disconnects	Can you customize which apps are protected?	Will it block all traffic or only VPN-tunneled traffic?
Windows	Blocks all non-Mullvad traffic by default	Often available, depending on client version	Mostly blocks all traffic to ensure privacy
macOS	Blocks traffic when VPN/session ends	Yes, with some versions offering per-app controls	Generally blocks all traffic to be safe
Linux	Strong default protection, varies by distro	May offer per-app rules with advanced configs	Strongly recommended to block all traffic
iOS	Integrated kill switch behavior in VPN profile	Limited per-app control due to iOS restrictions	Typically blocks non-VPN traffic while connected
Android	Similar to iOS, with OS-level VPN integration	Per-app control can exist depending on version	Usually blocks traffic to protect privacy

Notes:

The exact controls can vary by Mullvad client version and operating system. Always verify in the app’s settings.
For servers or headless devices, you may rely more heavily on OS firewall rules which can complement Mullvad’s kill switch.

Best practices for using Mullvad kill switch

Always enable the kill switch by default: Treat it as a baseline security setting.
Combine with a reliable DNS protection: Use Mullvad’s DNS or trusted privacy-friendly resolvers to minimize leaks.
Keep software up to date: Regular updates reduce security gaps that could undermine the kill switch.
Use a trusted kill switch test routine: Periodically verify behavior, especially after changing network environments (home, coffee shop, mobile hotspot).
Consider additional privacy measures: Use features like split tunneling with caution, as it can reintroduce leakage if misconfigured.
Verify on real traffic: When you routinely use P2P, streaming, or remote work, confirm no leaks across common apps and services.

When the kill switch is not enough: complementing privacy protections

Use a privacy-conscious browser configuration: Disable WebRTC, use privacy-focused extensions, and stay mindful of fingerprinting.
Enable firewall rules in tandem: In some setups, you can configure firewall rules as an extra safeguard beyond Mullvad’s built-in protections.
Use multi-hop or enhanced privacy modes if your threat model requires it: Mullvad supports advanced configurations that add layers of protection.
Randomize IPs and avoid predictable patterns: Some attackers leverage predictable IPs. Changing IPs can reduce tracking risk when privacy is critical.

Final recommendation

For most Mullvad users, turning on the kill switch and testing it regularly provides strong protection against IP leaks and DNS exposure. Combine the kill switch with good security habits, keep software updated, avoid leaking through WebRTC, and verify the setup across your devices. If you rely on Mullvad for high-stakes privacy, consider advanced configurations and periodic audits of your network, firewall rules, and app behavior. In short: enable Mullvad’s kill switch, test it, and maintain a privacy-conscious workflow to maximize protection. Windscribe kill switch