How can I have a 100% foolproof killswitch

[DogeX 8]

Hello,

While conducting research on the reliability of kill switches, I came across an article from Rtings which highlights that many VPNs leak traffic—even with the kill switch enabled—during a system reboot.

How can one prevent this type of leak from occurring?

[Staff 10208]

10 hours ago, DogeX said:

many VPNs leak traffic—even with the kill switch enabled—during a system reboot.

Hello!

This is by design to avoid permanent lock out on remotely accessed machines while allowing non-VPN traffic when wished. Please also note that the article is wrong in telling that there's a leak during a system reboot even when network lock is enabled: the leak may occur only if the Network Lock has not been engaged, for example if you have not started the AirVPN software.

On Linux systems you also have the option of setting a persistent network lock with Bluetit daemon, a component of the AirVPN Suite. As soon as the daemon starts it enforces the network lock, no matter whether a connection is started or not. If you have a systemd based Linux distribution, please note that the asinine systemd init startup is not deterministic and this is of course not our responsibility. Therefore you can't be sure when Bluetit will be started, regardless of the priority you wish.

If you need permanent blocking firewall rules surviving reboots even when the VPN software is not running the solution is straightforward: set permanent firewall rules as explained in various articles (a recent one is here https://airvpn.org/forums/topic/69097-permanent-kill-switch-for-eddie-client) or follow the suggestion included in the very same article you linked. Be aware that this setup is problematic on remotely accessed machines.

Kind regards