Troubleshooting

Kill switch isn't blocking traffic

How to confirm the WFP filters are installed, and what to do if they aren't.

Step 1 — Confirm the kill switch is enabled

Open the Fexyn app, go to Settings, find "Kill switch". Make sure the toggle is on. The default is on; if you've disabled it at some point, this is the fix.

Step 2 — Test it correctly

The right test:

Connect Fexyn.
Open a continuous network test in another window — e.g. ping 1.1.1.1 -t in PowerShell.
Disconnect Fexyn from the system tray (don't quit the app, just disconnect).
Watch the ping. With the kill switch active, you should see "Request timed out" or "Destination host unreachable" immediately.
Reconnect Fexyn. Pings resume.

If pings keep flowing during the disconnect, the kill switch isn't blocking. Continue to step 3.

Step 3 — Check the WFP service is running

The kill switch uses Windows Filtering Platform (WFP). The WFP service (Base Filtering Engine, BFE) is required for the firewall rules to load.

Press Win+R, type services.msc, press Enter.
Find "Base Filtering Engine" in the list.
Status should be "Running". Startup type "Automatic".
If it's stopped, right-click → Start. If it won't start, that's a Windows-level issue; continue to step 5.

Step 4 — Restart the Fexyn helper service

The Fexyn helper service installs the WFP filters when you connect. If it's in a stuck state, the filters may not have been applied.

Open services.msc as above.
Find "Fexyn VPN Helper Service" (or similar — exact name shown in services.msc).
Right-click → Restart.
Reconnect from the Fexyn app and re-test.

The helper service will reinstall the WFP filters from scratch on the next connect.

Step 5 — Check for conflicting firewall software

Other security products that hook into WFP can interfere with Fexyn's rules. Common culprits:

Norton 360 / Norton Security — has a deep WFP integration that can conflict.
Kaspersky Total Security — installs its own filtering layer.
ESET Smart Security — similar.
ZoneAlarm — older but still present on some machines.
Other VPNs running concurrently (Cloudflare WARP, Tailscale, NordVPN). Multiple VPNs install competing kill-switch rules and fight each other.

Quit (don't just disable) any other VPN. If you have a third-party security suite, temporarily disable its firewall component and re-test the kill switch. If it works without the security suite's firewall, add Fexyn to the suite's allowlist rather than leaving the firewall off.

Step 6 — Reinstall as a last resort

If nothing else works, uninstalling and reinstalling Fexyn rebuilds the helper service registration and the WFP rule installation from a clean state. Uninstall from Settings → Apps → Fexyn VPN. Reboot. Reinstall from fexyn.com/download/windows.