Direct answer

A kill switch is a safety behavior that blocks traffic when the secure connection is lost, so your remote work does not keep using the internet in an unintended way. Setup and decisions usually mean: deciding what connectivity failure you care about, which devices or apps should be protected, and how you will verify that blocking actually happens during real disconnect scenarios.

How it works: setup and the key decision points

Kill switch behavior is typically tied to the VPN tunnel state on a specific device. Setup usually involves configuring the VPN so that when the tunnel drops (for example, after a brief network interruption, Wi‑Fi handover, or a server reachability issue), the client blocks new traffic according to your chosen scope.

For a remote professional or small-business operator, the main decisions are practical:

  • Scope: Do you want protection for the whole device connection, or only for specific applications (like a browser used for work)?
  • Failure triggers: What counts as “lost” connectivity in your use case—temporary Wi‑Fi changes, DNS failures, captive portals, or VPN handshake problems?
  • Operational workflow: If you rely on local services (printers, internal web apps, collaboration tools), you need a plan for what should happen when protected traffic is blocked.
  • User experience trade-off: Overly broad blocking can interrupt legitimate work when the VPN is unstable; overly narrow blocking can leave some traffic exposed.

Practical context: remote-work conditions that influence behavior

Remote environments are variable: home networks, mobile hotspots, corporate Wi‑Fi, hotel/conference captive portals, and international travel can all change how quickly connections establish and how “failure” looks from the client’s perspective. Device differences also matter (OS version, browser behavior, background networking, and sleep/hibernate settings).

A practical approach is to align kill switch scope with your real risk:

  • If you must ensure work traffic never leaves the secure tunnel, you generally want broader protection and deliberate verification.
  • If only certain apps handle sensitive work, app-scoped blocking can reduce disruption—provided you’ve confirmed that other traffic paths don’t matter for your threat model.