Kill switch

A kill switch stops your device from reaching the internet outside the tunnel when the VPN connection drops unexpectedly. That way, even during a brief drop, your real IP address and unencrypted traffic stay hidden. In Colitu the kill switch works the way each operating system allows.

#Windows

On Windows the kill switch is on by default. To check or change it, use Settings → Connection → Kill switch.

• Colitu adds rules through the Windows Filtering Platform, the security layer built into Windows. While they are active, only the VPN core, the Colitu app, loopback, the TUN adapter, your local network (LAN) and DHCP can pass; everything else is blocked.
• In TUN mode the kill switch is active for as long as you are connected; traffic can't leave outside the VPN at all.
• In system proxy mode (the default mode) it engages the moment the tunnel is lost and keeps the internet closed until Colitu reconnects.
• When it engages, the home screen tells you and Colitu reconnects automatically. If you don't want to wait, you can turn the protection off.
• When you press Disconnect yourself, the kill switch doesn't engage and the internet works normally.
• If Colitu crashes, Windows removes the rules by itself, so your internet doesn't stay locked.

#Android

On Android the kill switch is provided by Android itself. Colitu takes you to the right screen:

1. In Colitu open the Account tab and tap Always-on protection under Features. Android's VPN settings open.
2. Tap the settings (gear) icon next to Colitu.
3. Turn on Always-on VPN.
4. Turn on Block connections without VPN.

From then on no app can reach the internet while Colitu isn't connected. The names and location of these settings can differ slightly between manufacturers; on most phones they are under Settings → Network & internet → VPN. Only one VPN app can be "always on" at a time.

#iOS

On iOS turn on Account → Features → Always-on protection. If the VPN drops because the network changed or it was switched off in Control Centre, iOS reconnects it right away.

This uses iOS's on-demand mechanism and brings the VPN back quickly; it is not a classic kill switch that blocks all traffic. Local networks are also kept outside the tunnel on iOS, so you can reach your local devices.

#Linux (beta)

On Linux the kill switch works in TUN mode only:

1. Under Settings → Connection → Mode choose All traffic (TUN).
2. In the same section make sure Kill switch is on. It is on by default but has no effect in proxy mode.
3. Make sure the nftables package is installed.

While the kill switch is active and the VPN drops, only the local network, the VPN servers and the Colitu account service stay reachable. The rules are removed automatically when the app exits, even after a crash.

#How do I check that it works?

1. Connect to Colitu and open the VPN connection test. The IP address and location should show the Colitu server and no leak should appear.
2. While connected, turn Wi-Fi or mobile data off for a few seconds and on again.
3. Pages should not load until Colitu has reconnected. Once it's back, run the test again; it should show the Colitu server again.
4. On Android, also disconnect in Colitu: with Block connections without VPN on, no site should open.

More tests: Connection tests.

#Troubleshooting