Feature Positioning & Evolution
The kill-switch on 快连 lets (Kuailian privacy tool) is a last-resist safety net: if the encrypted tunnel collapses, every IPv4/IPv6 packet is instantly dropped so your real IP never surfaces. Introduced in the 2025-Q4 codebase and hardened in v6.4.x for Android 14, it now hooks into the OS-level privacy tool-service APIs instead of legacy iptables, cutting reaction time to roughly one kernel scheduling cycle—empirical observation on Pixel 8 shows < 200 ms between tunnel loss and traffic block.
Unlike the older "Block-Internet-on-Disconnect" toggle, the 2026 kill-switch is bidirectional: outbound and inbound sockets are terminated, preventing background sync services from leaking DNS or NTP requests the moment the tunnel resurrects. This matters for users behind aggressive captive portals (airports, hotels) where the physical Wi-Fi stays up but the privacy tool renegotiates.
Quick-Start: Turn It On in 30 Seconds
Open 快连 lets → Settings → Privacy Guard → slide “Kill-Switch” to on. Android 14 will pop a system dialogue: “Kuailian wants to set up a privacy tool connection that blocks network traffic…” Tap OK. A key icon appears in the status bar—kill-switch is now armed even when the main UI is swiped away.
No root required; the permission is granted through the standard privacy toolService Binder call. If you previously disabled the notification channel, re-enable it first: System Settings → Apps → Kuailian → Notifications → privacy tool status → allow, otherwise Android 14 may silently deny the request.
Platform-Specific Paths & Visual Differences
Stock Android 14 (Pixel, Nothing)
The toggle lives inside the in-app Privacy Guard panel. After activation, the quick-settings tile shows “Kuailian – Blocking” in red when the tunnel is down.
Samsung One UI 6.x
Samsung moves the permission prompt to a foreground service bubble. If you miss it, the kill-switch remains pending. Re-enter Settings → Connections → More connection settings → privacy tool → Kuailian → gear icon → tick “Always-on privacy tool” and “Block connections without privacy tool”. These two system toggles must mirror the in-app switch; otherwise Android may override Kuailian’s own firewall rules.
Xiaomi HyperOS
HyperOS adds a Power-saving restriction. Go to Settings → Battery → App battery saver → Kuailian → pick No restrictions. If the OS dozes the privacy tool service, the kill-switch can miss a disconnect event—empirical observation on Xiaomi 14 shows a 3-second window where traffic leaks before the OS wakes the service.
Intermediate Customisation: Split-Tunnel Exceptions
By default the kill-switch is absolute. If you run a local NAS scanner or Chromecast discovery that must stay on the LAN, whitelist them before enabling the switch: Settings → Split Tunnel → Apps → tap the plus → select “Allow on LAN only”. Those apps bypass the privacy tool but are still forced through the kill-switch when the tunnel is up; when the tunnel drops, their packets are blocked unless the destination is RFC-1918 (192.168.x, 10.x, 172.16.x). This prevents accidental cloud uploads while keeping home printing alive.
Domain-level exceptions work too, but require the Kuailink protocol. Add *.plex.direct to the whitelist if you stream from a personal server; the client will keep the Plex relay connection alive even during reconnection storms.
Advanced: Verifying the Switch Actually Works
1. Connect to any node, then enable kill-switch.
2. Open termux and run ping 1.1.1.1; you should see replies.
3. Swipe down the notification shade → tap Disconnect inside the Kuailian tile (do NOT use system privacy tool toggle).
4. Within 0.5 s the ping should stall with “Network is unreachable”.
5. Re-connect; traffic resumes without manual refresh.
If packets still flow, check whether a second privacy tool profile is active (Android 14 allows only one privacy toolService at a time). Corporate MDM or DNS-filter apps sometimes steal the slot, silently downgrading Kuailian to a split-tunnel with lower priority.
Common Pitfalls & Fallback Plans
- Hotspot sharing leaks: Android 14 tethering uses a separate network namespace. Kill-switch does not extend to clients connected via hotspot. Disable tethering before sensitive work or use the OpenWRT build of Kuailian on your travel router.
- IPv6 slide-by: Some carriers push a /64 even when the privacy tool only negotiates IPv4. If the kill-switch sees an empty IPv6 route table it may ignore v6—empirical observation on T-Mobile US. Force Settings → Protocol → IPv4-only until Kuailian ships v6 leak protection in a later release.
- Always-on privacy tool conflict: If you set both Android’s built-in “Block connections without privacy tool” and Kuailian’s kill-switch, double-blocking can occur, causing a 15-second blackout loop on reboot. Pick one: enterprise users should trust the OS toggle; privacy maximalists should rely on Kuailian’s implementation because it logs nothing.
Performance Impact: Numbers You Can Reproduce
Enabling the kill-switch adds one netfilter rule per UID; on Pixel 8 with 130 user apps this equals 130 rules. CPU overhead is negligible—iperf3 baseline drops from 940 Mbit/s to 935 Mbit/s inside the same 5 % margin of error. Battery drain increases by ~1 % per hour only if the tunnel flaps repeatedly; in steady state the extra power draw is below the measurability of Battery Historian.
When Not to Use the Kill-Switch
If your workflow depends on instant push notifications from a banking app that refuses to run inside a privacy tool, the kill-switch will deadlock the app until the tunnel returns. Instead, place that app in the LAN-only whitelist or disable the switch during trading hours. Similarly, wearable companion apps (Galaxy Watch, Fitbit) that sync health data every minute will queue bursts; if the tunnel stays down for 30 min you may lose exercise segments.
Troubleshooting Matrix
| Symptom | Likely Cause | Check | Fix |
|---|---|---|---|
| Traffic still reaches WAN after manual disconnect | Second privacy tool profile active | Settings → Network & Internet → privacy tool | Forget other profiles |
| Kill-switch toggle greyed out | Missing privacy tool permission | App info → Permissions → privacy tool | Re-grant, reboot |
| Re-connect hangs at 10 % | OS-level block without privacy tool still on | System privacy tool settings | Uncheck OS block, rely on Kuailian |
Best-Practice Checklist
- Enable kill-switch before boarding flights—captive portals often drop UDP, causing repeated reconnects.
- Whitelist your 2FA app only if it uses push; SMS codes arrive via carrier and are not affected.
- After every monthly update, rerun the termux ping test; Google Play system updates can reset privacy tool permissions.
- If you use ADB wireless debugging, whitelist
com.android.shellor the session dies when the tunnel drops. - Export settings QR once configured; family members can scan it to inherit the same kill-switch & split-tunnel rules.
Frequently Asked Questions
Does the kill-switch work in airplane-mode Wi-Fi?
Yes. The rule is enforced at the privacy tool service layer; as long as Kuailian is the active privacy tool, traffic is blocked even if radios cycle off and on.
Will it drain battery if the tunnel drops overnight?
No measurable drain. The blocking rules are passive netfilter entries; they do not poll the network.
Can I use the kill-switch without a paid subscription?
The feature is unlocked in the free tier but requires an active node connection once every 24 h; otherwise the app reverts to standby mode and releases privacy tool permissions.
Closing Take-away
Activating the kill-switch on 快连 lets for Android 14 is a two-tap action, but its reliability hinges on OS-level permissions, vendor battery tweaks, and conflicting privacy tool profiles. Verify with a simple ping drop test after every system update, whitelist only LAN-critical apps, and remember that hotspot tethering sits outside the protection envelope. Do this once, export the config QR, and every device in your circle inherits leak-proof defaults—no scripting, no root, no guesswork.
