App kill switch vs router kill switch
The difference is scope. An app kill switch guards the device it runs on. A router kill switch guards everything behind the router, including devices that cannot run a VPN app, but it cannot protect a phone once it leaves the router Wi-Fi. [1][2][3]
| Feature | Protects | Default and modes | Captive portal impact |
|---|---|---|---|
| Proton VPN app kill switch | One device | Standard (accidental drops) or Advanced (always, on Windows, Linux GUI, iOS beta) | Must be off to log in when it blocks traffic |
| NordVPN Internet Kill Switch | One device, all traffic | Windows, Android 8+, Linux; macOS and iOS App Store versions use VPN bypass prevention | Turn off, log in, reconnect, re-enable |
| NordVPN App Kill Switch | Selected apps only | Off by default on Windows | Not covered by the portal article; turn it off if the page will not load |
| GL.iNet Tunnel Kill Switch (v4.8+) | Traffic assigned to that tunnel | On by default once the tunnel is active | Disable VPN connections during login |
| GL.iNet Enhanced Kill Switch (v4.8+) | All traffic not matching a tunnel | Off by default; Policy Mode only | Same |
| GL.iNet Block Non-VPN Traffic (v4.7 and earlier) | All router clients | Toggle in Global Options | Same |
What the vendor app kill switches actually block
Proton says its kill switch blocks all internet traffic on the device if the VPN connection drops, so your IP and DNS queries are not sent to the open internet until it reconnects. The standard mode only activates on accidental drops; the advanced mode allows internet access only when connected, and stays active after a restart. [1]
Proton lists platform caveats worth knowing on the road: on iOS and iPadOS some DNS requests from Apple services can bypass the VPN even with kill switch on; on iOS and macOS the kill switch prevents connecting to devices on your local network; and on most platforms kill switch is not compatible with split tunneling. [1]
NordVPN splits its feature by platform: an Internet Kill Switch that blocks all access when the VPN drops (Windows, Android 8 and later, Linux), an App Kill Switch that closes selected programs (Windows and the website macOS version), and VPN bypass prevention on the App Store iOS and macOS versions. [2]
How the GL.iNet router version differs
On GL.iNet firmware v4.7 and earlier, Block Non-VPN Traffic sits under VPN Dashboard, Global Options; if the VPN is disabled or disconnected, all devices on the router are restricted from the internet. [3]
From v4.8, the kill switch is per tunnel and turns on automatically when the tunnel is activated, and Policy Mode adds an Enhanced Kill Switch, off by default, that blocks any traffic that matches no VPN tunnel. Under All Other Traffic, Allow Non-VPN Traffic is enabled by default so traffic outside the tunnels can still reach the internet. [3][4]
Proton lists its own kill switch for its desktop and mobile apps, not for router configurations, so on a router you rely on the router setting. [8]
The router setting does not depend on each device's app, which is the main advantage for streaming sticks and guests. The trade-off is that a router kill switch cannot help a device that is not on the router network.
The captive portal sequence
NordVPN explains the conflict directly: Auto-connect starts the VPN as soon as you join the Wi-Fi, which prevents the portal from loading, and Kill Switch blocks all non-VPN traffic, which is exactly what stops the portal page from appearing. [5]
For a device: turn off Auto-connect and Kill Switch, disconnect, join the Wi-Fi, open a plain http:// address to trigger the redirect, finish the login, then reconnect and re-enable both. [5]
For a GL.iNet router: disable all VPN connections and AdGuard Home, complete the portal, then re-enable. Firmware v4.6 and later also has an Auto-Enable Login Mode for Public Hotspots option that suspends some services and switches DNS to automatic during login; GL.iNet warns this may leak your network activity to the hotspot provider. [6]
Leak check: IP and DNS in five minutes
IPLeak.net shows the IP addresses, DNS resolvers and WebRTC addresses a website can see. Run it once with the VPN off and once with it on, and compare. [7]
- With the VPN off on the hotel network, open ipleak.net and note the IP address and the country of the DNS servers. [7]
- Turn the VPN on (app or router) and reload. The IP should now belong to the VPN server location. [7]
- Check DNS detection: resolvers should no longer be the hotel or ISP ones you noted. [7]
- Check the WebRTC section in your browser; it should not show the IP you noted in step one. [7]
- On iPhone or iPad, expect Proton's caveat that some Apple service DNS can bypass the tunnel; that is documented behaviour, not a setup mistake. [1]
- Remember that a deliberate disconnect does not trigger Proton's standard kill switch, so a manual disconnect is not a valid test of that mode. [1]
Which to rely on
Use the app kill switch on any laptop or phone that leaves the room, and the router kill switch for devices that never run a VPN app. Running both is fine, but expect to switch both off briefly for each new captive portal. [1][3][5]
Questions before you decide
Why does my kill switch stop the hotel Wi-Fi login page?
NordVPN says its Kill Switch blocks all non-VPN traffic, which is exactly what stops a captive portal page from appearing. Its steps are to turn off Auto-connect and Kill Switch, log in, reconnect, then turn them back on. GL.iNet gives the same advice for routers: disable VPN connections while logging in.
Does Proton VPN standard kill switch block traffic if I disconnect on purpose?
No. Proton says the standard kill switch is only activated when the connection drops by accident. The advanced kill switch, available on Windows, the Linux GUI app and iOS or iPadOS in beta, only allows internet access while connected to Proton VPN.
Is the GL.iNet kill switch on by default?
On firmware v4.8 and later, GL.iNet says the per-tunnel Kill Switch is enabled by default once a tunnel is activated. The Enhanced Kill Switch, which blocks all traffic that matches no tunnel, is off by default and only available in Policy Mode.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Proton VPN: How to use kill switch Accessed 30 Oct 2026
- NordVPN Help Center: NordVPN Kill Switch, how does it work Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Kill Switch (Block Non-VPN Traffic) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard Accessed 30 Oct 2026
- NordVPN Help Center: How to log in to a captive portal Wi-Fi network while using NordVPN Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Connect to public hotspot with Captive Portal Accessed 30 Oct 2026
- IPLeak.net: IP, DNS and WebRTC detection test Accessed 30 Oct 2026
- Proton VPN: Product lifecycle stages (feature availability by platform) Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.