Android VPN settings: always-on, per-app and blocked connections

Android has more VPN machinery built into the system than any other consumer platform, and most of it sits in a settings screen people never open. Knowing what is there changes how reliable a tunnel is, and it explains several behaviours that otherwise look like app bugs.

Where the settings live

Settings, Network & internet, VPN, then the gear icon next to the app's entry. Some manufacturers move it — Samsung puts it under Connections, More connection settings — but the two switches are the same everywhere.

Always-on VPN

With this enabled, Android starts the tunnel when the device boots and restarts it whenever it drops. It survives reboots, app crashes and the system killing the app for memory.

Two things to know:

• The app must declare support for it. An app that has not is greyed out in this screen, and its own auto-connect setting is the only equivalent.
• It does not survive Safe Mode or a factory reset, which is expected but occasionally surprising when troubleshooting.

Block connections without VPN

This is Android's kill switch and it is genuinely absolute. With it on and the tunnel down, apps have no network. Not degraded, not unprotected — none.

That is what you want, and it produces the single most confusing symptom in mobile networking: a phone with full signal and working Wi-Fi where nothing loads. If a device suddenly has no connectivity and the VPN app was recently uninstalled or updated, this setting is the first place to look.

The switch is only available when Always-on VPN is enabled.

Per-app routing, and who controls it

Android supports routing some apps through the tunnel and excluding others, but the control lives in the VPN app rather than in system settings. VpnService exposes two methods, addAllowedApplication and addDisallowedApplication, and an app chooses one model or the other.

That difference matters:

• Allow-list: only the named apps use the tunnel. Everything else goes around it. Safer default for a narrow use case.
• Deny-list: everything uses the tunnel except the named apps. Safer default for privacy, because a newly installed app is covered automatically.

If an app offers split tunnelling, find out which model it uses before trusting it. A deny-list app that you configured expecting an allow-list is routing far more than you think, and an allow-list app configured the other way is routing far less.

The connection request prompt

The dialog saying an app wants to set up a VPN connection is a system dialog. No app can suppress it, style it or pre-approve it. It appears once per app install, and its purpose is to make it impossible for an app to start intercepting traffic silently.

An app claiming it can skip that prompt is either being installed by a device management profile — legitimate on a work phone — or is describing something that does not exist.

Private DNS, and why it fights the tunnel

Android's Private DNS setting, under Network & internet, sends every lookup to a DNS-over-TLS resolver you name, and it applies system-wide. When a VPN is up, those lookups still go to your chosen resolver rather than the tunnel's.

The lookups are encrypted, so your network operator cannot read them, but they do not go where the VPN's configuration said they should. If a leak test shows a resolver you did not expect on Android, Private DNS is the usual explanation. Set it to Automatic while the tunnel is up, or leave it and accept that DNS goes to a third party of your own choosing.

Battery optimisation

Android's battery optimiser can suspend a VPN app in the background, which drops the tunnel while the screen is off. Always-on VPN mostly prevents it, but on manufacturer skins with aggressive power management — several Chinese OEM builds in particular — the app also needs to be excluded from battery optimisation by hand, under Apps, the app, Battery, Unrestricted.

This is the cause of the majority of "the VPN disconnects overnight" reports.

Work profiles

On a device with a work profile, the profile owner can set an always-on VPN that applies only to work apps, and you cannot turn it off. Personal apps are unaffected and can run a separate VPN. Two tunnels on one device is normal here and not a misconfiguration.

Confirm it works

Open what is my IP in a browser on the phone. The address should belong to the server you picked. If you are using per-app routing, check from an app that is supposed to be inside the tunnel and one that is supposed to be outside it, because a split configuration that is inverted looks perfectly normal from one side.