Killswitch guidance / built-in leak protection

When the tunnel drops my traffic falls back to my normal IP, which defeats the point for whitelisting. A recommended killswitch config or a server-side option would help.