How to Set Up a VPN Kill Switch on a Router
Without a router-level kill switch, any brief interruption in your WireGuard or OpenVPN connection causes your router's routing table to silently fail back to the default ISP WAN gateway—instantly exposing your real residential IP address to every active socket. Here is how to configure a deterministic firewall kill switch on ASUS, GL.iNet, UniFi, and OpenWrt routers.
- Routing fallback is silent by default: When a virtual
tun11orwg0interface goes down, Linux removes its routes and forwards packets outeth0(WAN) unless blocked by a firewall rule. - Enable native Kill Switch toggles: Turn on
Block routed clients if tunnel goes downin ASUSWRT orBlock Non-VPN Trafficin GL.iNet. - Zone-based firewall isolation is foolproof: On OpenWrt, MikroTik, and pfSense, removing the
lan -> wanforwarding rule ensures LAN packets can only egress via thevpnzone. - Test by deliberately breaking the endpoint: Always verify your kill switch by changing the VPN server port to an invalid number and confirming that `curl ifconfig.me` times out.
How a Router VPN Kill Switch Works Under the Hood
When a VPN client tunnel comes up on a Linux-based router, it inserts high-priority routes—often using policy routing tables (ip rule and ip route show table 200) or overriding the default route via two half-routes (0.0.0.0/1 and 128.0.0.0/1)—so packets enter the virtual tunnel interface instead of the physical WAN port. However, if the remote VPN server restarts, an OpenVPN session times out, or the tunnel daemon crashes, the kernel tears down the virtual routes and falls back to the main routing table's default gateway (0.0.0.0/0 dev eth0).
A true Router VPN Kill Switch operates inside iptables or nftables (the FORWARD chain), not just the routing table. It marks packets originating from VPN-assigned LAN clients (or the entire LAN subnet) and inserts an explicit REJECT or DROP rule if those packets ever attempt to egress out the unencrypted physical WAN interface.
Enabling the Kill Switch on ASUS (VPN Fusion) and GL.iNet
On modern consumer VPN routers, the kill switch is a built-in checkbox—provided you know where it is hidden:
- ASUS Stock Firmware (VPN Fusion / 388 & 3006): Navigate to VPN > VPN Fusion and select your active WireGuard or OpenVPN profile. On stock 3006 firmware or ASUSWRT-Merlin (under VPN > VPN Director or VPN Client), set Block routed clients if tunnel goes down (Killswitch) to Yes. Note that on ASUS routers, the kill switch only remains enforced while the VPN profile toggle is left in the ON position; manually toggling the profile OFF disables the block.
- GL.iNet (Admin Panel v4.x): Go to VPN > VPN Dashboard, click Global Options (gear icon), and toggle Block Non-VPN Traffic to ON. When enabled, GL.iNet inserts strict firewall rules blocking WAN egress even if you manually stop the VPN client.
Configuring Kill Switches on UniFi Gateways and OpenWrt
On prosumer gateways, you implement a kill switch using explicit traffic/firewall rules so there is zero ambiguity:
On Ubiquiti UniFi (Network 8.1+ on UCG-Ultra / UDM-Pro), open Settings > Routing > Policy-Based Routes, select your VPN route, and ensure the Kill Switch checkbox (labeled Fallback: Block internet traffic if VPN disconnects) is checked. If using an older UniFi controller, create an explicit Traffic Rule that blocks Internet (WAN1) for your VPN VLAN while allowing traffic over the VPN interface.
On OpenWrt (LuCI), navigate to Network > Firewall > Zones. Assign your WireGuard/OpenVPN interface to a dedicated vpn zone with Masquerading enabled. Then edit the lan zone (or a dedicated iot_vpn zone) and change Allow forward to destination zones so it points only to vpn—completely removing wan from the destination list.
How to Safely Test Your Router Kill Switch Without Leaking
Never assume a kill switch checkbox works until you have verified it under a simulated tunnel failure. Do not test by simply clicking the "Disconnect" button in your router's VPN UI, because many consumer routers treat a manual user click on "Disconnect" as an instruction to tear down both the tunnel and its associated kill-switch rules.
Instead, simulate an unexpected remote server outage: edit your active WireGuard or OpenVPN profile and change the remote Endpoint IP to an unreachable reserved documentation IP (such as 198.51.100.1:51820) or block the VPN server IP on your upstream modem while leaving the router's VPN Client toggle switched ON. Then, from a LAN device assigned to that VPN policy, run ping 1.1.1.1 and curl -4 icanhazip.com. Both commands must fail with Destination Host Unreachable or time out completely—confirming zero packets escaped out the ISP WAN.
Router VPN Kill Switch Implementation by Platform
| Router Firmware / OS | Exact Setting / Mechanism | Behavior on Unexpected Drop | Behavior if User Toggles VPN Off |
|---|---|---|---|
| GL.iNet (OpenWrt v4.x) | VPN Dashboard > Global Options > Block Non-VPN Traffic | Blocks all WAN forwarding immediately | Continues blocking WAN until toggle is disabled |
| ASUSWRT / Merlin | VPN Director / Client > Block routed clients if tunnel goes down | Drops WAN forwarding for policy-routed IPs | Restores normal WAN access when manually turned off |
| Ubiquiti UniFi (OS 3.2+ / Net 8.x) | Routing > Policy-Based Routes > Kill Switch toggle | Drops routed VLAN/devices when tunnel fails | Pausing policy rule restores default WAN routing |
| OpenWrt (LuCI Firewall) | Firewall Zones: Forward 'lan' -> 'vpn' only (remove 'wan') | Kernel nftables drops all non-VPN egress | Remains 100% blocked even if wg0 interface is deleted |
| MikroTik RouterOS v7 | IP > Firewall > Filter: Drop out-interface=WAN src-address-list=VPN_LAN | Drops any packet attempting WAN egress | Always enforced regardless of tunnel state |
Router VPN Kill Switch Verification Checklist
- Bind all VPN-protected devices to static DHCP IP leases so policy-based kill-switch rules always target the right hosts.
- Enable the platform's native kill switch ('Block Non-VPN Traffic' on GL.iNet or 'Block routed clients if tunnel goes down' on ASUS).
- Ensure IPv6 traffic from VPN clients is also blocked from exiting the ISP WAN interface during a tunnel failure.
- Configure DNS to route strictly through the VPN tunnel so local router DNS lookups fail closed if the tunnel drops.
- Simulate an unscheduled tunnel drop (e.g., invalid endpoint port while keeping the VPN toggle ON) rather than clicking Disconnect.
- Run 'ping 1.1.1.1' and 'curl icanhazip.com' from a protected client during the simulated outage to verify 100% packet drop.
Frequently Asked Questions
If my router VPN kill switch activates, will I lose access to my router's local 192.168.1.1 login page?
No. A router kill switch only blocks forwarding between the LAN zone and the external WAN interface (the internet). Local Layer 2 and Layer 3 traffic inside your 192.168.1.0/24 subnet remains completely unaffected, so you can always log into 192.168.1.1 to switch VPN servers.
Why did my internet stay working on my real ISP IP when I clicked 'Stop' on my ASUS VPN profile?
On ASUS routers, the kill switch protects against unexpected tunnel drops while the profile remains in the 'Active / ON' state. If you manually click 'Deactivate' in the GUI, the firmware assumes you intentionally turned the VPN off. On ASUSWRT-Merlin VPN Director, however, rules stay enforced even if the client is stopped.
Does a router kill switch affect devices that are bypassed via split tunneling?
No, when configured with Policy-Based Routing, the kill switch only drops WAN traffic for the specific IP addresses or VLANs assigned to the VPN tunnel. Devices explicitly routed to the WAN (like a work laptop or gaming PC) will continue using normal internet even if the VPN tunnel goes down.
Related VPN Setup & Engineering Guides
- WireGuard Router Setup Guide (Client & Server) — Set up WireGuard VPN on ASUS, GL.iNet, UniFi, and MikroTik routers. Configure Curve25519 keys, AllowedIPs, MTU 1420 tuning, and NAT keepalive timers.
- OpenVPN Router Setup Guide (.ovpn Configuration) — Import and tune OpenVPN .ovpn profiles on your router. Configure AES-256-GCM encryption, UDP 1194 vs TCP 443 transport, TLS-Crypt keys, and split routing.
- Router Firewall Settings Explained (SPI, NAT & Rules) — Master your router firewall settings. Configure Stateful Packet Inspection (SPI), disable broken SIP ALG for VoIP, block WAN pings, and secure IPv6 rules.
- Tailscale Subnet Router vs WireGuard Setup Guide — Configure a Tailscale Subnet Router (tailscale up --advertise-routes=192.168.1.0/24) to access your home LAN behind CGNAT, or compare with native WireGuard.