guide · static export
Security

Set Up a VPN Kill Switch So Traffic Never Leaks

When the tunnel drops, Windows happily sends everything over the normal connection. A firewall rule makes that impossible until you say otherwise.

by@guidox updated:10/31/26 time:25 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:VPN client
TL;DR

Create a **block-all outbound** rule, allow only the **VPN adapter and its server**, then activate the rules together. Test by dropping the tunnel and watching the connection fail.

Before you start

Requirements

  • A VPN client with a known server address
  • Admin rights
  • A minute to test
Step by step

Instructions

01

Note the server and the adapter

Write down the VPN server address and the adapter name the client creates. Both are needed for the allow rules; guessing them produces a kill switch that blocks the tunnel as well.

ipconfig /all
02

Create the block rule first

In the advanced firewall, add an outbound rule that blocks all programs and all profiles. It is inactive until enabled, so nothing breaks while you build the rest.

wf.msc > Outbound Rules > New Rule > Block
⚠ warningName the rules with a clear prefix and the date. A leftover block rule is the reason some machine later has no internet.
03

Allow the VPN client and the server

Add allow rules that sit above the block: one for the client executable, one for remote addresses equal to the VPN server on its port. Firewall rules are evaluated in order.

Allow: <vpn-client>.exe -> Any
Allow: Any -> <server-ip>:<port>
04

Allow local traffic you still need

Printers, a local NAS and casting break under a strict kill switch. Permit the private profile for those addresses so the house keeps working while the internet stays blocked.

Allow: Any -> 192.168.0.0/16 (Private profile)
tipKeep the local exception narrow. A rule for the whole private profile allows any device on the network.
05

Test the failure case

Disconnect the VPN with the rules enabled and try to load a page. It has to fail. If it loads, one of the allow rules is too broad or the block rule is disabled.

06

Decide when the rules stay on

A kill switch that is always on needs a way out when the client itself is broken. Keep a second account or a documented one-line command that disables the two rules.

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
Troubleshooting

Common issues

Nothing works, not even the VPN

The allow rules are below the block rule or point at the wrong executable. Check the order in wf.msc.

The tunnel connects but pages time out

DNS still goes to a local resolver that is blocked. Allow the tunnel's DNS server or use encrypted DNS through the VPN.

The printer stopped working

The local exception is missing or limited to a different profile. Add the printer's address for the private profile.

Windows cannot install updates

Expected under a strict outbound block. Disable the rules for the update window, then re-enable them.

FAQ

Frequently asked

Is the client's own kill switch not enough?

It is a good first layer, but a crashed client can take it down with it. Firewall rules survive the process.

Does this slow the connection?

A firewall rule adds no measurable latency. The tunnel does.

How to undo this

Disable or delete the rules you created in **wf.msc > Outbound Rules**. Network access returns immediately, without a reboot.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress