diff --git a/install.sh b/install.sh
index db66c55..62d2aee 100644
--- a/install.sh
+++ b/install.sh
@@ -469,6 +469,16 @@ create_directories() {
 # Install killswitch script
 install_killswitch() {
     log "Installing permanent killswitch..."
+    warning "⚠️  KILLSWITCH WILL BLOCK ALL INTERNET ACCESS AFTER ACTIVATION!"
+    warning "⚠️  Only VPN connections will be allowed!"
+    echo ""
+    read -p "Activate killswitch now? This cannot be undone! (y/N): " -n 1 -r
+    echo ""
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        warning "Killswitch installation skipped. System is NOT protected!"
+        warning "Run 'systemctl start vpn-killswitch' to activate later."
+        return
+    fi
     
     # Create killswitch script
     cat > /usr/local/bin/vpn-killswitch.sh << 'EOFSCRIPT'
@@ -1175,8 +1185,8 @@ main() {
     
     install_dependencies
     create_directories
-    install_killswitch
-    install_vpn_provider  # Replaces install_mullvad
+    install_vpn_provider  # Install VPN first (needs internet)
+    install_killswitch    # Then activate killswitch (blocks internet)
     install_backend
     install_webui
     setup_services