0

I have used a few VPN services in the past, and one thing I have noticed in their clients is that they often feature a "killswitch", in order to kill your internet connection in case the VPN ever goes down, to prevent the user from not noticing that the VPN has died, and accidentally sending traffic through an insecure channel. That makes sense to me - most OS's, if they detect one connection go down will automatically switch to whatever else is available.

What I don't understand is, if this is such a prominent need for VPN connections, why don't OS's seem to have this feature "baked in"? Some way to say, "Send ALL TRAFFIC through this one tunnel interface, and NO OTHER INTERFACES should be used." It seems like in many use-cases for VPNs, the ability to direct ALL traffic through the tunnel (and none through ANY other interface) is critical.

I have seen workarounds with e.g. setting up routing tables in Linux to accomplish this, but it seems like such a strong need that one would expect OS's to have it baked into the VPN settings.

Is there simply not demand for this feature at the OS level? Or is there some technical reason why it is particularly difficult/tricky to implement?

  • It is an isolated use case. The majority of VPN users until recently were (and probably still are) business customers who use VPN to access internal resources. For them this "kill switch" is not that useful, as without VPN those resources are not available anyway. – George Y. Aug 22 '18 at 4:15
  • And of course the "kill switch" is implemented using OS features, so you can say it is implemented at the OS level, one just need to configure it. On Linux this is fairly easy to do using standard networking tools. – George Y. Aug 22 '18 at 4:16
4

A VPN is not something too special from the OS perspective. It is essentially just another (virtual) network interface. And routing specifies which traffic is forwarded through which interface, i.e. it can be most traffic through the VPN, it can be only selected traffic through the VPN ("split VPN") etc.

A "kill switch" is nothing special either. It is just a routing rule or local firewall rule to make sure that sensitive traffic (i.e. all non-local traffic for a typical use of a VPN) will never be send out to any network interface except the VPN interface. In other words, it is just setting up rules for a secure fallback in case the VPN dies. And while these rules are setup from user space, they actually end up to be implemented in the OS kernel.

Calling this kind of setup a "kill switch" is just marketing. There is no switch at all which gets actively triggered if the VPN dies. It is only that the previously setup secure fallback rules get implicitly used if the VPN dies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.