# Killswitch **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [November 20, 2023, 11:30am UTC](https://forum.gl-inet.com/t/killswitch/35335 "2023-11-20T11:30:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![drhiii](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/90db22/32.png) [@drhiii](https://forum.gl-inet.com/u/drhiii)\ **Post date:** [November 20, 2023, 11:30am UTC](https://forum.gl-inet.com/t/killswitch/35335/1 "2023-11-20T11:30:21Z")
Have read the forums posts on this subject but wanted to ask anyway… has anyone created a killswitch based on iptables installed into the plugins under OpenWrt? Is that what under Global Options/Block non-VPN traffic is considered? A version of a killswitch? ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [November 20, 2023, 3:26pm UTC](https://forum.gl-inet.com/t/killswitch/35335/2 "2023-11-20T15:26:20Z")
> [@drhiii](#): > > Is that what under Global Options/Block non-VPN traffic is considered? A version of a killswitch? I would not call it a killswitch but it works like that, yes. ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [November 20, 2023, 5:37pm UTC](https://forum.gl-inet.com/t/killswitch/35335/3 "2023-11-20T17:37:58Z")
Why wouldn’t you? ‘Lockdown mode’, ‘killswitch’ is synonymous w/ ‘block non-VPN traffic.’ … to what degree they’re effective is a very different story. I suppose we can thank our Big Tech overlords for that one: > **[Android leaks connectivity check traffic | Mullvad VPN](https://mullvad.net/en/blog/2022/10/10/android-leaks-connectivity-check-traffic)** > > An ongoing security audit of our app identified that Android leaks certain traffic, which VPN services cannot prevent. The audit report will go public soon. This post aims to dive into the finding, called MUL22-03. > **[Apple iOS vulnerability causes connections to bypass VPN](https://protonvpn.com/blog/apple-ios-vulnerability-disclosure/)** > > We discovered a security vulnerability in Apple’s iOS that causes connections to remain unencrypted even after connecting to VPN. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [November 20, 2023, 5:54pm UTC](https://forum.gl-inet.com/t/killswitch/35335/4 "2023-11-20T17:54:36Z")
> [@bring.fringe18](#): > > Why wouldn’t you? ‘Lockdown mode’, ‘killswitch’ is synonymous w/ ‘block non-VPN traffic.’ In my opinion an killswitch will be an active process monitoring the connection and killing traffic as soon as there is an problem. From my point of view the „monitoring“ part is missing here. —- And, more important: A killswitch would support split tunneling. „Block non-VPN traffic“ does not. ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [November 20, 2023, 6:08pm UTC](https://forum.gl-inet.com/t/killswitch/35335/5 "2023-11-20T18:08:59Z")
So would a ping routine to a known host that kills the client interface on timeout qualify? If so I don’t see much of a difference in using WG’s `persistent keepalive` directive, provided the VPN provider doesn’t do some sort of throttling of such packets, of course. It’s an interesting question given WG is a stateless protocol. (Meh; I disagree on split-tunnelling but I can see how it has its uses.) [https://www.wireguard.com/protocol/#connection-less-protocol](https://www.wireguard.com/protocol/#connection-less-protocol) ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [November 20, 2023, 6:23pm UTC](https://forum.gl-inet.com/t/killswitch/35335/6 "2023-11-20T18:23:22Z")
> [@bring.fringe18](#): > > (Meh; I disagree on split-tunnelling but I can see how it has its uses.) Unfortunately you have to use it in certain situations. ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [November 20, 2023, 6:26pm UTC](https://forum.gl-inet.com/t/killswitch/35335/7 "2023-11-20T18:26:25Z")
Yeah, no doubt. I’m more of a proponent of PBR though: > **[Welcome to docs.openwrt.melmac.net!](https://docs.openwrt.melmac.net/pbr/#Description)** > > stangri’s OpenWrt Packages Documentation. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [November 20, 2023, 7:04pm UTC](https://forum.gl-inet.com/t/killswitch/35335/8 "2023-11-20T19:04:39Z")
Afaik VPN policy will utilize PBR. At least they routes are stored at the same place and can be edited by luci PBR plugin. ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [November 20, 2023, 7:11pm UTC](https://forum.gl-inet.com/t/killswitch/35335/9 "2023-11-20T19:11:38Z")
Yup; it also allows preloading ASNs… something VPN split tunnelling doesn’t do. You should give it a punt! ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 4:27am UTC](https://forum.gl-inet.com/t/killswitch/35335/10 "2025-10-29T04:27:16Z")