Thanks for the report! Moved to KVM forums.
Yeah, it makes sense. Since KVM network interfaces are visible on the host operating system, firewalls such as presumably what the NordVPN kill switch is doing can disrupt Whonix KVM.
I doubt this is fixable? @HulaHoop
@maxeth: You’d have to use a VPN kill switch (also called fail-closed mechanism) that is compatible with Whonix KVM. There is vpn-firewall but untested with Whonix KVM, I think. Also as per Avoid Non-Freedom Software I suggest to avoid the presumably non-freedom software NordVPN client and use a Freedom Software VPN client such as OpenVPN.