The Problem
VPN connections can drop β due to network changes, server maintenance, Wi-Fi handoffs, or your laptop waking from sleep. During that brief window, your device reverts to its normal connection. Your real IP address, DNS queries, and unencrypted traffic are exposed.
Most users never notice. The VPN reconnects in seconds, but the damage may already be done: your ISP saw where you were going, an ad network logged your real IP, or a tracker correlated your identity.
How Kill Switch Works
Astria VPN's Kill Switch uses macOS's built-in packet filter (pf) β the same firewall used by enterprise security tools. When Kill Switch is enabled:
- A firewall rule is installed that blocks all outbound traffic except connections to the VPN server itself and local DHCP.
- If the VPN tunnel drops, the firewall stays active. No traffic leaves your machine β not even DNS queries.
- When the VPN reconnects, traffic flows normally through the tunnel again.
This isn't an application-level filter that can be bypassed. It's a kernel-level firewall rule β nothing gets through.
What Happens During Sleep/Wake
When you close your laptop lid and reopen it later, the VPN tunnel is gone. Without Kill Switch, your device immediately starts sending traffic over the open network.
With Kill Switch enabled, pf blocks everything until Astria VPN detects the wake event and re-establishes the tunnel. The app detects wake events within seconds and automatically reconnects.
Always On by Default
Kill Switch is enabled by default in Astria VPN. We recommend keeping it on at all times β the only scenario where you might want to disable it is if you need guaranteed network access even when the VPN is down.
You can toggle it in Settings β Kill Switch.
Android
On Android, Astria VPN uses the system VPN service with the "Block connections without VPN" option. This provides the same protection at the OS level β no traffic leaves the device unless it goes through the VPN tunnel.