How to Set Up a VPN Kill Switch on a Phone at Sea: 15 Steps

Updated 10 November 2026 · vpn, ship-wifi, android, iphone

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

Setting up a VPN kill switch on a phone at sea takes a few minutes, and how you do it depends on the phone. On Android, turn on Always-on VPN plus Block connections without VPN in the system settings. On iPhone there is no system toggle, so you need your VPN app's own kill switch. Then log into ship Wi-Fi before you lock it down.

Most guides skip the ship. Crew Wi-Fi drops when the satellite link fades, when a mast blocks the antenna, or when your portal session runs out. A kill switch reacts to every one of those drops. Set it up in the wrong order and you can lock yourself out of the crew network completely. This guide covers the setup on both phones, the login order that keeps you online, and a simple test to run before you trust it.

What a VPN kill switch does on a phone

A kill switch blocks all internet traffic from your phone whenever the VPN tunnel is down, so nothing leaves the phone unprotected while the app reconnects. Without one, your phone falls back to the open connection each time the tunnel breaks, without telling you. Your messaging apps, email and browser carry on over the bare ship or port network until the VPN comes back.

On land that gap might be a second or two. On a ship the tunnel can break many times a day, and each break opens the same gap again. If you use a VPN on crew Wi-Fi for privacy, the kill switch is what makes that privacy hold between drops. To understand how much the ship's network can actually see, read what your ship's IT department can see through a VPN. For picking the VPN itself, the starting point is the guide to the best VPN options for cruise ship crew.

The trade-off needs saying up front. A kill switch puts blocking ahead of staying connected. The setup guides read for this article (Droidcrunch, ESET's help pages and a Google Docs setup guide, all read on 7 November 2026) describe the same behaviour: while the tunnel is down, the protected phone or apps cannot reach anything, including the cloud tools you use for work. None of them tests this against work applications at sea, so how often it bites on a patchy satellite link is unknown from the published sources. Exact page addresses for every source are listed under "Sources you can check" at the end of this page.

Android vs iPhone kill switch: what differs

The big difference is where the switch lives. On Android it is part of the operating system and covers any VPN app you point it at. On iPhone it lives inside each VPN app, and every app does it its own way. This table sums up what the published sources say.

Choosing a VPN app to use with a kill switch

The kill switch is only as good as the app behind it, so the choice matters most on iPhone. Providers named in the sources above include ESET VPN, VPN Super and Aura VPN. TechRadar's roundup of five top VPN choices for Android is one published list to compare against.

NordVPN is one more option: NordVPN (affiliate link; the site may earn a commission). The sources read for this page do not document NordVPN's kill switch settings, its protocol limits on iPhone, or its behaviour on ship Wi-Fi, so none of that is claimed here. Its price is unknown from these sources: the search results only mention approximate prices for NordVPN and Surfshark without an attributable pricing page, so check the provider's own pricing page on the day you buy, because prices change. Whichever app you pick, look for its kill switch article before paying, and confirm which protocol the setting needs.

How to set up a VPN kill switch on Android

On Android the kill switch is built into the system: you turn on Always-on VPN, then Block connections without VPN, for the VPN app you use. Guides from Droidcrunch (droidcrunch.com/vpn-kill-switch/) and Windscribe (windscribe.com/blog/vpn-kill-switch/), read on 7 November 2026, say these controls exist on Android 7 and later, and that together they block traffic whenever the tunnel is unavailable.

Do this while you still have a decent connection, ideally in port or on a Wi-Fi you trust.

1. Install your VPN app, sign in, and connect once so the app gets its permissions and server list.
2. Open Settings and type "VPN" into the settings search bar. On Samsung phones the path is Settings > Connections > More connection settings > VPN.
3. Tap the gear icon next to your VPN app.
4. Turn on Always-on VPN.
5. Turn on Block connections without VPN.
6. Run the leak test described further down this page.

Menu names vary a little between phone makers, so the search bar is the quickest way in. If your VPN app also has a kill switch in its own settings, you can turn that on too. The system setting sits underneath the app and still blocks traffic if the app itself crashes.

Keep work apps usable on Android

Once the block is on, every app on the phone goes offline whenever the VPN drops. If you need a softer setup, look for per-app rules inside your VPN app. Aura's help pages (help.aura.com/s/article/vpn-kill-switch), read on 7 November 2026, say its kill switch lets Android users add specific apps to the list, so only those apps are cut off when the tunnel fails. That lets you protect banking and email while a navigation or weather app keeps working. Keep in mind that this is weaker protection than the system-wide block.

How to set up a VPN kill switch on an iPhone

An iPhone has no system-wide kill switch toggle, so the protection has to come from your VPN app. Depending on the provider, the setting is called kill switch, bypass prevention or Connect on Demand. Droidcrunch (droidcrunch.com/vpn-kill-switch/) and Gizmodo (gizmodo.com/best-vpn/kill-switch) both describe this split in their kill switch guides, read on 7 November 2026.

The general steps are the same for most apps:

1. Open your VPN app and go to its settings.
2. Look for a kill switch, a block or bypass setting, or Connect on Demand, and turn it on.
3. Check which protocol the kill switch needs, and set that protocol.
4. Connect, then run the leak test below.

The details depend on the app, and that is where people go wrong. Here is what three providers say in their own documentation.

ESET VPN

ESET's help pages (help.eset.com/evpn/1/en-US/connection.html), read on 7 November 2026, describe a combination of settings for iPhone. You enable Connect on Demand, turn on Auto-Connect, choose Manual connection mode, and use WireGuard. ESET presents this combination as its way to get kill switch behaviour on iOS. It needs all four settings, so a single missed toggle leaves the gap open.

VPN Super

VPN Super's support article (vpnsuper.com/support-articles/vpn-kill-switch), read on 7 November 2026, says its kill switch works only with the IKEv2 or OpenVPN protocols. This matters at sea. Many crew switch protocols to cope with satellite latency, and if you move to a protocol the kill switch does not support, the protection stops without any warning. The comparison of WireGuard and OpenVPN on high-latency satellite links explains why people switch in the first place.

Aura VPN

Aura's help pages (help.aura.com/s/article/vpn-kill-switch), read on 7 November 2026, say the kill switch control on iPhone and iPad lets you add websites, where Android users add apps. On an iPhone that means you choose which sites are cut off when the tunnel drops.

Where iPhone protection stops

Even a working app kill switch has limits on iOS. Windscribe's kill switch article (windscribe.com/blog/vpn-kill-switch/), read on 7 November 2026, reports that Apple's networking rules can let some DNS queries for Apple services bypass the VPN. It also reports that iOS may not close connections that were already open when the VPN connects.

One habit follows from that second point. Connect the VPN first, then close and reopen the apps that matter, such as mail, banking and messaging, so they reconnect through the tunnel. If an app was already running on the bare connection before the VPN came up, it may keep using that connection.

The captive portal problem: how to set up a kill switch at sea without locking yourself out

Log into the ship's Wi-Fi portal first, and only then let the kill switch take over. With the block active, your phone may be unable to load the login page at all. A captive portal is the login or voucher page the crew network shows before it lets you out to the internet. The VPN cannot connect until you pass that page. The kill switch blocks everything that is not going through the VPN. Put those two rules together and you get a deadlock: no portal, no VPN, no internet.

Whether your particular phone gets the portal page through with the block on varies by phone and network. The sources read for this guide, as of 7 November 2026, do not test kill switch behaviour on cruise ship, offshore, satellite or other maritime Wi-Fi, and they give no maritime failure reports. Whether a given ship network, satellite link or intermittent connection causes traffic leakage is unknown. So plan as if the portal will not load, and use this order:

1. Close every app you care about, so nothing syncs during the short unprotected window.
2. On Android, turn off Block connections without VPN and leave Always-on VPN on. On iPhone, pause the app's kill switch or Connect on Demand.
3. Join the crew Wi-Fi and complete the portal login or enter your voucher.
4. Wait for the VPN to connect, then turn the block or kill switch back on straight away.
5. Reopen your apps.

The window between step 2 and step 4 is the only time you are unprotected, and you control exactly how long it lasts. Keep it short and open nothing else during it.

The same deadlock comes back when your portal session expires. If the phone suddenly shows Wi-Fi connected but no internet, that is often the kill switch doing its job after the portal has taken your session back. Run the login order again. For the deeper reasons portals and VPNs clash, see why port and ship captive portals block your VPN connection.

Two other situations look similar. If the tunnel keeps dropping and reconnecting, every drop now means a short blackout, and the fixes in why a VPN keeps disconnecting on ship Wi-Fi apply. If the ship's firewall blocks VPN protocols outright, the kill switch turns that into no internet at all. The steps in what to do when your VPN is blocked by a ship's firewall come first in that case.

How to test your kill switch before you trust it

The test is simple: connect the VPN, disconnect it by hand, and check that the internet stops. Two published setup guides, both Google Docs guides read on 7 November 2026, recommend exactly this. Neither names a publisher or a date of its own, so treat them as general guidance, not as a maritime procedure. Run the test in port or on a connection you are not paying for by the minute.

1. Connect the VPN and load any web page to confirm you are online.
2. Disconnect the VPN from inside the app.
3. Try to load a different web page. With the kill switch working, it should fail.
4. Reconnect the VPN and load the page again. It should now open.

If the page in step 3 loads, your kill switch is not covering the phone. On Android, go back and check that both system toggles are on for the right app. On iPhone, check that the app's kill switch is on and that you are using a protocol it supports. Run the test again after any app update or protocol change, because either one can change how the switch behaves.

Pros and cons of a VPN kill switch on ship Wi-Fi

A kill switch is worth having if you use a VPN for privacy, but it has real costs on a satellite link.

Pros

• Your traffic stays inside the tunnel between drops, so apps cannot fall back to the open crew network without you noticing.
• Android's version is built in and free, and it covers any VPN app you set it up for.
• A crashed VPN app does not leave you exposed on Android, because the system block sits underneath the app.
• Per-app or per-site rules in some apps let you protect what matters and leave the rest alone.

Cons

• Every link drop becomes a short blackout, and on a patchy satellite connection that can happen often.
• Captive portals can lock you out, so you have to follow a login order each time a session starts or expires.
• iPhone protection has documented gaps, including Apple service DNS that can bypass the VPN and connections that stay open from before the tunnel came up.
• Some iPhone kill switches only work with certain protocols, so switching protocol for speed can switch the protection off without warning.
• Work tools go offline with the tunnel, which hurts if you need a cloud app during a watch handover or a quick call home.

Who should not turn on a kill switch

Some crew are better off without one, at least for now.

• If your ship's network blocks VPN protocols completely, a kill switch only guarantees you get no internet at all. Fix the VPN connection first.
• If the phone belongs to your company and is managed by its IT department, ask them before changing VPN settings, since their policies may already control this.
• If you use a VPN only to reach a streaming library and do not care about privacy on crew Wi-Fi, the blackouts cost you more than the switch gives you.
• If you depend on staying reachable through a very unstable link, such as waiting on a family call during a bad stretch of weather, consider per-app rules instead of a full block.

What is not known

As of 7 November 2026, the sources read for this guide do not establish the following, so this page does not state them:

• Current prices and plan limits for any VPN named here, NordVPN included. Pricing pages were not available in an attributable form.
• How any kill switch behaves on a specific cruise ship, offshore or satellite network, or behind a specific captive portal.
• An adoption percentage or a controlled benchmark from a clearly identified research organisation.
• Any price change, launch or shutdown in the last six months.

Re-check each vendor's own help page before relying on a setting described here.

Sources you can check

Each statement above comes from one of these pages, all read on 7 November 2026 unless noted. Addresses are given as text so you can type or paste them into a browser.

• Droidcrunch, VPN kill switch guide: droidcrunch.com/vpn-kill-switch/ (Android 7 and later controls; Samsung menu path)
• Gizmodo, VPN kill switch guide: gizmodo.com/best-vpn/kill-switch (no system-wide iOS toggle)
• ESET VPN help, connection settings: help.eset.com/evpn/1/en-US/connection.html (Connect on Demand, Auto-Connect, Manual mode, WireGuard)
• VPN Super support article: vpnsuper.com/support-articles/vpn-kill-switch (IKEv2 or OpenVPN only)
• Aura help article: help.aura.com/s/article/vpn-kill-switch (apps on Android, websites on iPhone and iPad)
• Windscribe blog, VPN kill switch: windscribe.com/blog/vpn-kill-switch/ (Apple DNS bypass; existing connections)
• Two Google Docs setup guides, linked in the test section above (connect, disconnect, check)
• TechRadar, best VPN for Android: our 5 top choices, listed in the claims for this page; read on 10 November 2026

FAQ

Does an iPhone have a built-in VPN kill switch?

No. iOS has no general system toggle that blocks traffic when the VPN drops. The protection has to come from your VPN app, through a setting called kill switch, bypass prevention or Connect on Demand. Check the app's help pages for which protocol the setting needs.

Will a kill switch stop me logging into ship Wi-Fi?

It can. With the block active, the captive portal login page may not load, and the VPN cannot connect until you log in. Turn off the block briefly, log in, let the VPN connect, then turn the block back on straight away.

Which VPN protocol should I use with a kill switch at sea?

Use a protocol your kill switch actually supports, then pick the best performer among those. VPN Super's support article, read on 7 November 2026, says its kill switch only works with IKEv2 or OpenVPN. ESET's iPhone setup uses WireGuard. Check your own app's documentation before changing protocol.

Why does my phone show Wi-Fi connected but no internet with the kill switch on?

Usually the VPN tunnel is down and the kill switch is blocking traffic, which is what it is meant to do. On ship Wi-Fi the most common cause is an expired portal session. Run the portal login order again and the VPN should reconnect.

Does a kill switch protect me on port Wi-Fi as well?

Yes. It works the same way on any network, because it only cares whether the VPN tunnel is up. Port and terminal Wi-Fi often has portals too, so the same login order applies there. The guide to port Wi-Fi security covers the other risks on those networks.

Verdict

The setup is short once you know which phone you have. On Android, enable Always-on VPN plus Block connections without VPN, and the system handles the rest. iPhone needs a VPN app's own kill switch, set up exactly as that app's documentation says, including the protocol it requires. At sea, the part that saves you is the order: portal first, then VPN, then the block. Test it once in port and again after every app update.

Related reading

• The best VPN options for cruise ship crew
• Why port and ship captive portals block your VPN connection
• Why a VPN keeps disconnecting on ship Wi-Fi

About this guide

This guide was built from Android settings documentation, the help pages of ESET, VPN Super and Aura, and published kill switch guides, all read on 7 November 2026. No hands-on test log sits behind the app-specific claims, and the claims list on this page shows which statements are the vendor's own word and which come from third-party guides. The aim is a plain, checkable answer on how to set up a VPN kill switch on a phone at sea.