§ 01
Definition
Android has a built-in 'Always-on VPN' option with a companion 'Block connections without VPN' switch. Windows, macOS and iOS offer similar behaviour through VPN apps, configuration profiles or device management.
§ 02
How it works
The system reconnects the chosen VPN app at boot and after network changes. With blocking enabled it acts as an OS-level kill switch: apps cannot send traffic outside the tunnel, even for the seconds before the VPN reconnects.
§ 03
Why it matters
App-level kill switches can miss traffic during startup or app crashes; an OS-level setting closes that gap. The trade-off is that captive portals and some local network features may stop working until you allow them.