VPN Kill Switch & DNS Leak Protection: Essential OPSEC Setup

Last month, a user on Dread posted that they had their Tor session exposed for roughly 90 seconds after their VPN tunnel dropped while their laptop was still resolving DNS through their ISP. The session was tied to a market order on Nexus, and the fallout was immediate: account flagged, funds frozen, vendor relationship burned. The cause was not a compromised Tor circuit. It was a missing vpn kill switch and zero dns leak protection configured at the system level. This guide walks through exactly how to prevent that scenario from happening to you.

What We’re Setting Up and Why It Matters

When you connect to Tor through a VPN, your traffic flows in two stages: from your device to the VPN server, then from the VPN server into the Tor network. A kill switch blocks the first stage entirely if the VPN tunnel drops, so your real IP never touches the clearnet even for a millisecond. DNS leak protection forces every name lookup through the VPN’s encrypted resolver, preventing your operating system from quietly asking your ISP “what is the IP of example.onion” in the background. Without both, you can have a perfectly working Tor Browser while your underlying network stack is screaming your home IP to anyone listening.

The threat model is straightforward. An adversary running a market like DarkMatter, DrugHub, or Torzon does not need to break Tor to deanonymize you. They just need to catch the moment your VPN reconnects and logs your real address. DNS leaks are even worse because they happen invisibly, often before the user notices anything wrong.

Prerequisites

Before configuring anything, make sure you have a VPN provider that supports modern protocols and publishes independent audit reports. Mullvad VPN is a strong baseline choice because it supports WireGuard, ships with a built-in kill switch, and accepts anonymous payment including Monero and cash. Avoid free VPNs, browser extensions marketed as VPNs, and any provider that requires an email or phone number for signup.

You also need a clean baseline. Update your operating system fully, close any background sync clients (cloud storage, email, chat apps), and disconnect from any network you do not control. If you are using Tails OS, most of this is already handled at the firewall level, but you still want to verify behavior before trusting it.

Step-by-Step Configuration

Step 1: Choose WireGuard Over OpenVPN

WireGuard is the modern default for a reason. It has a smaller codebase (around 4,000 lines versus OpenVPN’s hundreds of thousands), which means fewer attack surfaces and faster auditing. It also handles roaming better, so when you switch from Wi-Fi to Ethernet or wake your laptop from sleep, the tunnel reconnects faster. In Mullvad’s settings, select WireGuard as the protocol and pick a server location that is geographically sensible but not your home country.

Step 2: Enable the Kill Switch at the Application Level

Most reputable VPN clients, including Mullvad, offer two kill switch modes. The “always-require-VPN” or “lock-down” mode blocks all traffic unless the tunnel is active. This is the only setting worth using for darknet work. The “app-level” kill switch that only blocks specific programs is not sufficient because it does not catch system-level DNS queries or background services. Toggle the lock-down switch on, then verify it works by manually disconnecting the VPN and confirming you have zero connectivity.

Step 3: Configure DNS Leak Protection

On Windows, go to Settings > Network & Internet > your adapter > DNS, and set it to manual. Point it to the VPN provider’s DNS servers or to a privacy-respecting resolver like 9.9.9.9 or 1.1.1.1 with DNS-over-HTTPS enabled. On Linux, edit /etc/resolv.conf or use systemd-resolved with DNSOverTLS=yes. On macOS, configure DNS directly in the network pane and disable any “limit IP tracking” features that route to Apple servers. The goal is to ensure that if the VPN tunnel drops, your system has no cached DNS resolver to fall back to.

Step 4: Disable IPv6 and WebRTC

IPv6 traffic can bypass your VPN tunnel entirely if the VPN only handles IPv4. Disable IPv6 at the network adapter level on every operating system you use. In Tor Browser, WebRTC is already disabled by default, but if you are using a regular browser for any pre-Tor research, disable it manually or use an extension that blocks it. WebRTC can leak your local network IP even through a VPN, which is enough to fingerprint your session.

Verification Steps

Connect to your VPN, then visit ipleak.net, dnsleak.com, and browserleaks.com. Each site should show only the VPN server’s IP and DNS resolver, never your ISP or your real geographic location. Disconnect the VPN and try to load any website. If the kill switch is working, nothing should load. Reconnect and confirm traffic resumes. Run these tests monthly because operating system updates can silently reset network settings.

Common Issues and Troubleshooting

If DNS still leaks after configuration, check your browser’s DNS-over-HTTPS setting. Chrome and Firefox can override system DNS and send queries directly to their own resolvers, bypassing your VPN. Disable DoH in the browser or configure it to use the same resolver as your VPN. If the kill switch fails to engage, reboot after enabling it because some clients only lock down after a full restart. On Linux, verify with sudo iptables -L that the firewall rules are actually loaded.

Additional Security Recommendations

Run Tor Browser only after the VPN tunnel is confirmed active. Never log into personal accounts over the same session. Use Tails OS for high-value operations because it forces all traffic through Tor and leaves no traces on disk. Keep your VPN client updated, and rotate servers every few weeks. The combination of a properly configured vpn kill switch, dns leak protection, and WireGuard through a provider like Mullvad VPN creates a layered defense that catches the exact failure mode that burned the Dread user mentioned at the start.