I appreciate your claim of being a network engineer, but it’s understandable that we might be skeptical about credentials shared under a pseudonym. Nevertheless, your points are worth discussing.
You’re right here, and I think it resolves the whole point of this thread: iOS and macOS do not support a fully reliable, leak‑proof kill‑switch for any VPN, including Proton VPN. The operating‑system network stack lacks an API that can guarantee all traffic is blocked when the VPN disconnects, so the kill‑switch cannot function perfectly. This limitation has been reported to Apple (including by Proton) but has not been addressed.
I haven’t tested this personally because I don’t use Apple devices, so my answer is based on reports from multiple users and security researchers.
They sometimes work, but they don’t behave the same way on every Linux distro or VPN client. In my own experience (Mullvad on Arch and Debian works fine, but I had issues with Proton in the past), you can’t just set it and forget it.
If you really want to be sure nothing leaks when the tunnel drops, add a few custom firewall rules (iptables, nftables, or whatever you prefer). That gives you a solid “no‑traffic‑without‑VPN” safety net that works regardless of the distro you’re using.
I agree with this suggestion. A warning about the limitations of kill switches on certain platforms and distros would be helpful for users. Yes, even though I don’t like Proton for many reasons (political, usability, lack of Linux support, better options), it was the gate to my privacy journey and I believe it is a good option for most people who wants to avoid Big Techs.
Suggestion for Privacy Guides: Add a warning such as “Don’t put all your trust in the built‑in kill‑switch,” and link to a short tutorial on configuring those firewall rules on Linux.
Some useful links I found about Android leaks and macOS leaks on Mullvad’s blog:
Android leaks connectivity check traffic
DNS traffic can leak outside the VPN tunnel on Android
macOS sometimes leaks traffic after system updates
I want to point out that we already discussed issues with VPN on Linux here:
ProtonVPN IP Leakage on Linux and Workaround
Your VPN Kill Switch Won’t Stop All Leaks
Auto sleep + vpn (mullvad, not in lockdown mode) = leak?