Summary
Want full protection from possible leaks? Turn on our Firewall feature so that if the VPN connection fails for whatever reason, no data will leave your device, keeping you protected.
GOODBYE IP LEAKS | Windscribe’s Firewall Prevails Where Killswitches Fail
Firewall vs. Killswitch
A firewall blocks ALL connectivity outside of the VPN tunnel to ensure zero leaks of any kind if the VPN disconnects, while a Killswitch still allows packets to leave your device between the time your VPN disconnects and the program(s) you have in use realize the VPN is disconnected.
A firewall is a proactive solution, whilst a killswitch is a reactive measure. If the VPN connection drops, there is nothing that needs to be done, and not a single packet can leave the machine, since the firewall will not allow it. In geek terms it fails closed.
Block All Leaks
Our firewall blocks all types of leaks, including (but not limited to): traffic leaks, DNS leaks, IPv6 leaks, and maybe even tears.
Feature Availability
The Firewall setting is available on our Windows, Mac and Linux apps. On Android and iOS, you can use “Always On VPN”, which has the same effect and is built directly into the OS. Both features are located under “Connection” preferences.
Automatic Mode
This will enable the firewall when you connect to a Windscribe location and disables it when you disconnect. It also keeps your connection secure by disabling your internet if the application crashes unexpectedly or the connection to the VPN server is interrupted.
Manual Mode
This gives you full control of when you want to have the firewall on and off. Keep in mind that if you turn it on yourself, you only get internet when connected to the VPN or until you turn the firewall off. Closing the application will turn the firewall OFF but only if you close it yourself, not if it crashes.
Always-on Mode
This will restrict your internet entirely to using the VPN. Your internet connection will be disabled until you connect to a location or disable Always-on mode. Even if the application crashes, you exit it entirely or your computer restarts, you won't have internet until you reconnect to a Windscribe server. This is the most secure mode for our firewall.
Always-on+ Mode
For the tinfoil hat elite. This mode blocks everything — including API calls. That means no server lists updates, no stats, no account management, its just you and the Windscribe app, nothing else. Use it only if you know what you're doing, and even then… maybe think twice.
Windscribe
Apps
Company
© 2026 Windscribe Limited