The Problem

VPN connections can drop — due to network changes, server maintenance, Wi-Fi handoffs, or your laptop waking from sleep. During that brief window, your device reverts to its normal connection. Your real IP address, DNS queries, and unencrypted traffic are exposed.

Most users never notice. The VPN reconnects in seconds, but the damage may already be done: your ISP saw where you were going, an ad network logged your real IP, or a tracker correlated your identity.

How Kill Switch Works

Astria VPN’s Kill Switch uses macOS’s built-in packet filter (pf) — the same firewall used by enterprise security tools. When Kill Switch is enabled:

A firewall rule is installed that blocks all outbound traffic except connections to the VPN server itself and local DHCP.
If the VPN tunnel drops, the firewall stays active. No traffic leaves your machine — not even DNS queries.
When the VPN reconnects, traffic flows normally through the tunnel again.

This isn’t an application-level filter that can be bypassed. It’s a kernel-level firewall rule — nothing gets through.

What Happens During Sleep/Wake

When you close your laptop lid and reopen it later, the VPN tunnel is gone. Without Kill Switch, your device immediately starts sending traffic over the open network.

With Kill Switch enabled, pf blocks everything until Astria VPN detects the wake event and re-establishes the tunnel. The app detects wake events within seconds and automatically reconnects.

Best Kept On

We recommend keeping Kill Switch on at all times — the only scenario where you might want to disable it is if you need guaranteed network access even when the VPN is down.

You can toggle it in Settings → Kill Switch.

Across Platforms

macOS — a kernel-level rule in the system packet filter (pf), as described above.
Windows — the Astria VPN background service installs a system network filter: until the tunnel is back, no traffic leaves outside the VPN.
Android — the system VPN service with “Block connections without VPN”: nothing leaves the device except through the tunnel.
iPhone and iPad — Kill Switch works at the level of the system VPN profile: if the tunnel drops or is switching while you intend to stay connected, traffic does not leak onto the open network.

The principle is the same everywhere: either the protected connection is up, or there is no traffic.

On Android: Kill Switch and Always-on VPN on Android · Android guide