How does VPN network locking work?

The Mechanics of a Network Lock

1. Modifying the Routing Table

When you connect, the VPN client assigns a virtual network interface and updates your computer’s routing table. It redirects all default internet traffic away from your physical Wi-Fi or Ethernet adapter and forces it through the virtual, encrypted VPN tunnel.

2. Active Monitoring

A background service inside the VPN application continuously scans the status of the connection and the health of the tunnel. It checks for sudden drops in signal, server timeouts, or changing local networks every few milliseconds.

3. Enforcing Firewall Rules

The moment a disruption is detected, the VPN client commands the native operating system firewall (such as Windows Defender Firewall or macOS Packet Filter) to enact strict block rules. These rules typically state: Allow outgoing/incoming traffic exclusively through the designated VPN interface; drop everything else. Because the active VPN tunnel interface vanishes or disconnects during a drop, the firewall rule immediately treats all general internet access as unauthorized and severs connectivity entirely.

4. Restoring Access

Once the VPN client successfully re-establishes contact with a remote server, it updates the routing parameters and lifts the firewall block, allowing data to flow securely again.

Configuring ExpressVPN Network Lock on Windows 11

To set up and manage the network lock on ExpressVPN for Windows 11, you will be using their built-in feature called Network Lock. ExpressVPN enables this by default to prevent data leaks if your connection drops.

How to Configure Network Lock

1. Open the ExpressVPN app on Windows 11.
2. Click the Options menu icon (three horizontal lines) in the top-left corner.
3. Select Options, which opens a new settings window.
4. Go to the General tab.
5. Under the Network Lock section, you will see two checkboxes:
   • Stop all internet traffic if the VPN disconnects unexpectedly: Check this box to keep the kill switch fully active.
   • Allow access to devices on the local network (such as printers or media servers): Check this if you still want to print or access shared local folders while the internet is blocked.

How it Works Under Windows 11

ExpressVPN integrates directly with the Windows Filtering Platform (WFP) APIs. Instead of constantly fighting with native Windows Defender Firewall rules, ExpressVPN hooks into the WFP layer at the kernel level. The moment the app detects a handshake failure with the VPN server, it instructs the WFP to drop all outgoing and incoming packets that do not originate from the ExpressVPN tap/tun adapter.

How to Safely Test It

If you want to verify that Network Lock is actually working on your Windows 11 machine without pulling your physical router cables:

1. Connect to any ExpressVPN server.
2. Open a command prompt (cmd) or browser window and keep a ping or website handy.
3. Open your Windows Task Manager (Ctrl + Shift + Esc).
4. Find the background process for ExpressVPN and force-terminate the core connection process, or simply disconnect your Wi-Fi network for 5 seconds and reconnect.
5. You should instantly see a notification from ExpressVPN stating that the traffic has been blocked, and you will notice your browser cannot load any pages until the app successfully reconnects.