"Block connections without VPN": Android's built-in kill switch

Block connections without VPN is a toggle in Android's system VPN settings that stops every app on the phone from reaching the internet unless the VPN tunnel is up. It sits under the gear icon next to the VPN app's name, alongside Always-on VPN, and it only works with always-on turned on. Android itself enforces it, which makes it the only kill switch on the platform that does not depend on the VPN app staying alive.

What it blocks

While the toggle is on and the VPN is not connected, Android drops all traffic from every app: browsers, messaging, email sync, app updates, and system services that talk to the internet. The single exception is the VPN app itself, which needs to reach its server to bring the tunnel up. It applies on Wi-Fi and on mobile data alike, and it holds during every gap the tunnel can have:

The last row is the one to remember. The block does not know the difference between the VPN failing and you turning it off. If you disconnect deliberately, you have no internet until you reconnect or go back into Settings.

How to turn it on

1. Open Settings > Network & internet > VPN. Samsung phones put it under Settings > Connections > More connection settings > VPN and Xiaomi under Settings > Connection & sharing > VPN; other manufacturers vary, and searching Settings for "VPN" finds it on all of them.
2. Tap the gear icon next to your VPN app.
3. Turn on Always-on VPN. The block toggle stays greyed out until this is on.
4. Turn on Block connections without VPN.

There is no confirmation and no restart. From this moment, if the tunnel is down, so is your internet. The always-on explainer covers the first toggle on its own.

Why it lives in the system, not the app

A VPN app on Android controls only the traffic that enters its own tunnel. It has no supported way to stop other apps using the network directly. If the app is killed, whatever it was doing to hold traffic back is gone with it. Android, on the other hand, sits underneath every app and can refuse to route their packets anywhere but the tunnel. That is why the real kill switch is a system setting, and why an app that offers its own is either flipping this setting for you or offering something weaker. The kill switch post goes into the details.

Side effects to expect

Wi-Fi sign-in pages stop working. Hotel, airport and café networks that ask you to accept terms before granting access need a browser to load their page. With the block on, the browser cannot reach it, and the VPN cannot connect until you have signed in. Turn the block off, sign in, and turn it back on. The captive portal post explains why this loop happens.

Short pauses look like outages. Every time the VPN reconnects, traffic stops until it is back. On a good network that is a second or two; on a poor one it can be longer. If you see "no internet" for a moment after walking out of Wi-Fi range, that is the block holding the line, not the VPN breaking.

A stopped VPN means a stopped phone. If the VPN app is uninstalled, disabled, or refuses to start, the block is still on and nothing loads. Android does not clear it for you. The fix is the same gear icon.

Excluded apps are unaffected. Apps that the VPN has placed outside its tunnel through split tunnelling were never inside it, so the block does not touch them. Treat the exclude list as a list of apps that are also exempt from the kill switch.

How to check it is really on

Go back to the VPN list in Settings. The app should show "Always-on" beneath its name, and the gear screen should show both toggles on. A VPN app can also read the state itself; an app that shows you Android's actual setting is telling you something true, whereas an in-app toggle labelled "kill switch" is a claim you cannot verify from the app alone.

If it is on and you have no internet even with the VPN showing connected, the block is not the problem; look at VPN connected but no internet instead.

When to use it

Turn it on if the reason you run a VPN is that the local network must never see your traffic: on office, campus or hotel Wi-Fi where that is the whole point. Leave it off if you use a VPN casually and would rather have working internet during the reconnect gaps. There is no wrong answer, only a trade between a gap that is always closed and a phone that never pauses.

Culvert VPN relies on this system setting rather than an in-app kill switch, reports Android's real always-on and block state on its Settings screen with a link to change it, and is on Google Play.