

Protonvpn has a Killswitch: https://protonvpn.com/support/what-is-kill-switch
A kill switch is available to all Proton VPN users on Windows, macOS, Linux, iOS and iPadOS. Newer versions of Android now have built-in kill switch feature, as explained below.
Please note that our regular kill switch feature can’t protect you if you intentionally disconnect from a VPN server. However, the feature does protect you while switching servers with Proton VPN.
Our Windows and Linux apps now also feature an Advanced kill switch. In addition to protecting you from accidental VPN disconnections, this prevents you from accidentally using the internet without the VPN turned on, and it will persist when you shut down and restart your device. You will not be able to connect to the internet if you manually disconnect the VPN without also disabling Advanced kill switch.
or are you in a different scenario where that doesn’t work?
I’ve configured my router to set up a VPN connection to proton ( wireguard config ). I then decide which devices gonout without vpn and which with VPN. ( Default being with VPN ). If the wireguard tunnel happens to go down, the devices can’t surf the web.
I think it’s MAC based, but I’m not sure
Ah! I can’t get a fire stick here so no experience with that.
The asus router I have has a feature called VPN fusion. I specifically bought a set of routers for my home that are in front of my ISP router because I wanted a single SSID and wanted to set my own DNS servers without having to specify them per device . They (ISP) keep restricting features on their router ( can barely do anything on them nowadays ). Also switching ISPs became easier as any config is done in my devices rather than theirs.
I THINK it’s Mac based, but I really can’t say. I named the devices on my router and they keep reconnecting as the same device. Either that or it uses some combination of info from the device to identify it.
E.g.: my work MacBook should switch MAC addresses every time it connects to a WiFi, but it’s consistently identified by my router.
Additionally, they have some routers that are supported by custom firmware ( asuswrt-merlin ). Mine don’t support it unfortunately. https://www.asuswrt-merlin.net/