On the configs I've seen, "killswitch" is a few lines that tell iptables to stop sending when the connection drops. I don't know how tunnenblick does it, but this might actually, and I'm not joking, be a job for applescript? Since it looks like wireuard doesn't do killswitch on its own. http://krypted.com/mac-security/command-line-firewall-manage... might be a starting point.