Kill Switch

Kill Switch blocks internet access without a VPN, preventing traffic from going directly when the tunnel drops or has not connected yet. Open Settings → Kill Switch to see availability and status.

Windows

Run Qmesh as administrator, open Settings → Kill Switch and turn it on. The screen also provides an administrator restart button.

Blocking takes effect immediately for IPv4 and IPv6. It stays enabled after disconnecting the VPN, closing Qmesh or a core crash. Enabling it during a connection restarts the cores to apply protected DNS settings.

To restore normal internet access, turn Kill Switch off as administrator. If the UI is unavailable, run an elevated PowerShell terminal:

& 'C:\Program Files\qmesh\qmesh.exe' --qmesh-reset-network

Adjust the installation path if necessary. The command removes only Qmesh's network block.

Loopback, the Qmesh interface, its Xray/TUN cores and narrowly scoped DHCP traffic are allowed. Explicit direct routes, application exclusions and DPI bypass through those cores remain allowed. Kill Switch does not turn those routes into VPN traffic. Once the cores stop, ordinary applications cannot connect directly.

In system proxy mode, applications that ignore the proxy will be blocked. Use TUN for general application access. Standalone zapret2 without a VPN is incompatible with this block.

System DNS has no separate direct exception. Protected TUN handles DNS inside the tunnel. If Xray has no DNS configuration, encrypted Cloudflare DNS addressed by IP is used for bootstrap. Explicit provider DNS settings remain unchanged and must work without the system resolver; otherwise connection may fail while protection stays enabled.

Normal uninstallation removes the block; an application upgrade keeps it. Do not manually delete Qmesh while Kill Switch is enabled. This mechanism does not claim protection during early boot before Windows networking services start.

Android

Android manages persistent blocking:

1. Open Settings → Kill Switch → Open VPN settings.
2. Open Qmesh VPN options.
3. Enable Always-on VPN.
4. Enable Block connections without VPN.
5. Return to Qmesh and refresh status if needed.

If Qmesh is not listed yet, connect once and approve Android's VPN permission before returning to these settings.

Labels differ by device. Before the first VPN connection or on older Android versions, the system status may be unavailable; check the system settings directly. Blocking may prevent internet access until the VPN connects. App exclusions are governed by Android. Disable blocking through the same system settings.

An active TUN or proxy process is not confirmation of Kill Switch. A successful HTTPS check only confirms that a control endpoint replied; it does not test traffic blocking on tunnel failure, all application routes or leaks. See connection status.