diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1ffc34e..bd4d8a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - OpenVPN: Support for `--route-nopull`. [#280](https://github.com/passepartoutvpn/tunnelkit/pull/280)
 - OpenVPN: Support for `--remote-random-hostname`. [#286](https://github.com/passepartoutvpn/tunnelkit/pull/286)
+- Use .includeAllNetworks for best-effort kill switch. [#300](https://github.com/passepartoutvpn/tunnelkit/pull/300)
 
 ### Changed
 
diff --git a/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift b/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
index 75b8bb5..e1799ab 100644
--- a/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
+++ b/Sources/TunnelKitOpenVPNManager/OpenVPN+ProviderConfiguration.swift
@@ -59,6 +59,9 @@ extension OpenVPN {
         /// The client configuration.
         public let configuration: OpenVPN.Configuration
         
+        /// Enables kill switch.
+        public var killSwitch: Bool?
+
         /// The optional username.
         public var username: String?
         
@@ -95,7 +98,7 @@ extension OpenVPN {
 
 extension OpenVPN.ProviderConfiguration: NetworkExtensionConfiguration {
 
-        public func asTunnelProtocol(
+    public func asTunnelProtocol(
         withBundleIdentifier tunnelBundleIdentifier: String,
         extra: NetworkExtensionExtra?
     ) throws -> NETunnelProviderProtocol {
@@ -112,6 +115,9 @@ extension OpenVPN.ProviderConfiguration: NetworkExtensionConfiguration {
         }
         protocolConfiguration.disconnectOnSleep = extra?.disconnectsOnSleep ?? false
         protocolConfiguration.providerConfiguration = try asDictionary()
+        if #available(iOS 14, *), let killSwitch = killSwitch {
+            protocolConfiguration.includeAllNetworks = killSwitch
+        }
         return protocolConfiguration
     }
 }
diff --git a/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift b/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
index 380b559..7502dae 100644
--- a/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
+++ b/Sources/TunnelKitWireGuardManager/WireGuard+ProviderConfiguration.swift
@@ -49,6 +49,8 @@ extension WireGuard {
 
         public let configuration: WireGuard.Configuration
 
+        public var killSwitch: Bool?
+
         public var shouldDebug = false
 
         public var debugLogPath: String? = nil
@@ -73,7 +75,7 @@ extension WireGuard {
 
 extension WireGuard.ProviderConfiguration: NetworkExtensionConfiguration {
 
-        public func asTunnelProtocol(
+    public func asTunnelProtocol(
         withBundleIdentifier tunnelBundleIdentifier: String,
         extra: NetworkExtensionExtra?
     ) throws -> NETunnelProviderProtocol {
@@ -83,6 +85,9 @@ extension WireGuard.ProviderConfiguration: NetworkExtensionConfiguration {
         protocolConfiguration.passwordReference = extra?.passwordReference
         protocolConfiguration.disconnectOnSleep = extra?.disconnectsOnSleep ?? false
         protocolConfiguration.providerConfiguration = try asDictionary()
+        if #available(iOS 14, *), let killSwitch = killSwitch {
+            protocolConfiguration.includeAllNetworks = killSwitch
+        }
         return protocolConfiguration
     }
 }