Most guides show you how to configure Gluetun. Almost none of them show you how to verify the killswitch is actually working — not just configured.

This is the gap. You can have Gluetun running, qBittorrent connecting through it, and still have a broken killswitch that leaks your real IP the moment the VPN drops. I learned this the hard way.

Here's how to set it up correctly and test it properly.

What the Killswitch Actually Does

Gluetun is a VPN client that runs as a Docker container. The killswitch ensures that if the VPN connection drops, all traffic from dependent containers stops completely - it doesn't fall back to your real IP.

The key mechanism: instead of connecting containers to Gluetun over a network bridge, dependent containers (qBittorrent, Radarr, Sonarr, Prowlarr) share Gluetun's network stack directly using network_mode: service:gluetun . This means they have no independent network access — if Gluetun goes down, they go offline.

The Compose Setup

Here's the correct pattern.…