Kill switch & LAN protection

Two safety features protect you from traffic leaking outside the tunnel:

• The kill switch blocks all traffic whenever the tunnel is down, so nothing escapes onto the physical network during a drop or reconnect.
• TunnelCrack protection keeps local‑network traffic inside the tunnel, so a hostile Wi‑Fi network can’t trick your traffic into leaking onto the LAN.

Both are on by default and live in the profile editor.

Kill switch

What it does. Once a tunnel has successfully come up, the kill switch blocks all traffic any time the tunnel is not up — while reconnecting, or after an unexpected drop. Without it, your apps would silently fall back to the normal, unprotected connection the moment the VPN blinks.

Editor option: Kill switch — “Once connected, block all traffic whenever the tunnel is down to prevent data leaks.”

What you’ll see

When the kill switch is holding traffic, the connection screen shows Blocked and the notification reads Blocked — kill switch active. To get out of it:

• Reconnect to bring the tunnel back up, or
• Disconnect to switch the kill switch off and restore normal networking.

The kill switch only arms after the first successful connection. If a connection never comes up, it won’t block anything.

Interaction with split routing

The kill switch blocks everything when the tunnel is down. If you use a split‑routing mode — where most traffic intentionally bypasses the tunnel — that bypassing traffic would also be cut off during a reconnect. The editor shows a non‑blocking note when you combine the two:

The kill switch blocks all traffic whenever the tunnel is down, but this routing mode sends most traffic outside the tunnel — that traffic would be cut off too while the VPN reconnects.

This is a heads‑up, not an error — decide which matters more for your use.

TunnelCrack protection (“LocalNet”)

The problem. TunnelCrack is a class of attacks where a hostile network (say, a malicious Wi‑Fi hotspot) advertises routes that make your device treat public targets as “local,” so that traffic bypasses the VPN and leaks in the clear. The “LocalNet” variant abuses local/private address ranges.

What Rammbock does. With TunnelCrack protection on (the default), the local/private ranges (RFC 1918 and link‑local) are routed through the tunnel too, closing that leak.

Editor option: TunnelCrack protection — “Route local‑network traffic through the VPN too, blocking ‘LocalNet’ leaks on hostile Wi‑Fi. Turn off to reach LAN devices (NAS, printer) while connected.”

When to turn it off

Turn it off when you need to reach devices on your local network while connected — a NAS, a printer, a local media server, another machine at home. With protection off, traffic to these ranges uses your normal LAN instead of the tunnel:

10.0.0.0/8      172.16.0.0/12    192.168.0.0/16
169.254.0.0/16  fc00::/7         fe80::/10

The trade‑off: on an untrusted network, turning it off re‑opens the LocalNet leak. Only do it on networks you trust.

Only meaningful in full tunnel

TunnelCrack protection only applies in Full tunnel mode. In a split‑routing mode, some traffic already bypasses the tunnel by design, so local‑network leaks remain possible regardless. The editor notes this if you combine them:

TunnelCrack protection can’t fully apply in a split‑routing mode: some traffic intentionally bypasses the tunnel, so local‑network leaks remain possible.

Recommended settings

If in doubt, keep both on — that’s the safe default.