Android's "blocked connections" notification explained
The notification comes from Android's block connections without VPN setting, which is its kill switch. With it enabled and no tunnel up, the system denies all network access and tells you it is doing so. It is working as configured rather than failing.
4 min read
A phone with full signal, working Wi-Fi and no internet at all, plus a persistent notification about blocked connections, is one of the most confusing states Android produces. It is also entirely deliberate.
What the setting does
Settings, Network & internet, VPN, the gear beside your VPN app, then Block connections without VPN. Android's documentation calls it lockdown mode.
With it on, the system permits network traffic only through the VPN interface. When the tunnel is down, apps do not get a degraded connection or an unprotected one — they get nothing, and the system posts the notification to explain why.
This is a stronger guarantee than any app-level kill switch, because it is enforced by the platform rather than by a process that has to be running.
The four situations that trigger it
The VPN app was uninstalled or updated. The setting survives; the tunnel does not. This is the most common cause of a phone that suddenly has no network for no apparent reason.
The tunnel cannot connect. A blocked network, an expired configuration, a server that is down. The lockdown holds while the client retries.
The device has just booted. Lockdown applies from boot, before the client has connected. A few seconds of no network at startup is expected.
The app crashed. Same effect as the first case until it restarts.
Clearing it
If you want the network back immediately, turn the setting off:
Settings → Network & internet → VPN → gear icon → Block connections without VPN → off.
If the VPN app is gone entirely, the VPN entry may still be listed with the setting attached. Remove the profile, or reinstall the app and then remove it properly.
If you want to keep the protection and fix the underlying problem, work out why the tunnel is not connecting: try a different server, check whether the network blocks UDP, and confirm the account or configuration has not expired.
Why you should probably keep it on
The notification is annoying and the guarantee is real. Without lockdown, a dropped tunnel means apps continue on the normal network, in the clear, with no indication anything changed. That is the failure mode a kill switch exists to prevent, and on a phone — which changes networks constantly and reconnects while in your pocket — it is not a hypothetical.
The correct mental model is that the notification is the protection working, not the protection failing.
Always-on, which is the companion setting
Block connections without VPN is only available when Always-on VPN is enabled, because a lockdown with nothing configured to restore the tunnel would simply be a phone with no network.
Always-on restarts the tunnel at boot and after a drop. Together the two mean the tunnel is up whenever the network is, and traffic is blocked whenever it is not.
The app has to declare support for always-on to appear here. One that has not is greyed out, and its own auto-connect setting is the only equivalent — a weaker one, because it depends on the app running.
Work profiles behave differently
On a device with a work profile, the administrator can configure always-on with lockdown for work apps only. You cannot turn it off, and it does not affect personal apps. If the notification mentions a work profile, the setting belongs to the organisation and the helpdesk is the right place to take it.
Battery optimisation makes it worse
Android's power management can suspend a VPN app in the background. With lockdown on, that turns into a phone that loses all connectivity while the screen is off and recovers when you unlock it.
Exclude the VPN app from battery optimisation — Settings, Apps, the app, Battery, Unrestricted. On several manufacturer builds this is required rather than optional, and it is the single most common fix for overnight disconnections.
Confirming everything is healthy afterwards
Once the tunnel is up, open what is my IP and check the address belongs to the server you picked. The combination worth having is lockdown on, always-on on, battery optimisation off, and a verified exit address. At that point the notification should only ever appear for the few seconds after a reboot.
