Summary
The client can't offer a leak-proof kill switch. Full tunnel via an exit node (0.0.0.0/0) hides the IP while connected, but leaks the real IP in the reconnect gap (tunnel down after a network drop until On-Demand restores it).
What we tried
- Route-based full tunnel (0.0.0.0/0 in NEIPv4Settings.includedRoutes): leak-proof only while connected; leaks during reconnect.
- includeAllNetworks = true: seals the gap, but ~10s after connect the management/relay connection collapses (0 peers, management → Connecting…) — it captures the engine's own signal/relay sockets and loops them.
- excludedRoutes workaround: not possible — the signal server address isn't exposed by the SDK, and relay/peer endpoints are runtime-only and change.
Environment
- NEPacketTunnelProvider + NETunnelProviderManager, On-Demand enabled
- Peer connection at collapse: relayed
- Exit node advertising 0.0.0.0/0, force-relay on
Ask
Track support for a kill switch. The underlying fix is in the SDK — protect the engine's own sockets so includeAllNetworks doesn't collapse the connection, or expose signal/relay endpoints for excludedRoutes. Filed here:
netbirdio/netbird#6708
Happy to share logs / reproduction.
Summary
The client can't offer a leak-proof kill switch. Full tunnel via an exit node (0.0.0.0/0) hides the IP while connected, but leaks the real IP in the reconnect gap (tunnel down after a network drop until On-Demand restores it).
What we tried
Environment
Ask
Track support for a kill switch. The underlying fix is in the SDK — protect the engine's own sockets so includeAllNetworks doesn't collapse the connection, or expose signal/relay endpoints for excludedRoutes. Filed here:
netbirdio/netbird#6708
Happy to share logs / reproduction.