Below you will find three ways to connect (an app, a manual IKEv2 profile, a WireGuard/OpenVPN config file), exact menu paths for Pixel, Samsung One UI and Xiaomi HyperOS, Always-on and split tunneling setup, leak checks, how to turn off and delete a profile, and a troubleshooting table. If you are new to the topic, start with what a VPN on a phone is and why you might need one.
If you want a ready-made option without manual settings, see LiMP VPN features and pricing: the app for Android 8 and later installs as an APK from the official website, with app filtering and automatic server selection built in.
Ways to Set Up a VPN on Android: Which to Choose
There are three fundamentally different ways to connect a VPN on Android. The first is to install your provider's app: it creates the VPN profile, manages keys, switches servers and protocols and updates itself. The second is to create a profile manually in system settings by entering the server address and credentials — this is how corporate VPNs are usually connected. The third is to import a WireGuard config (.conf file or QR code) or an OpenVPN config (.ovpn) into a universal client, if your provider or administrator issues such files.
For most people the right choice is an app. Android's built-in client supports neither WireGuard nor OpenVPN, and on Android 12 and later only IKEv2/IPSec options remain when you create a new profile. On top of that, an app can reconnect after a drop, prevent DNS leaks, run its own kill switch and pick the nearest server, while a manual profile can do none of this.
| Criterion | Provider app | Manual system profile | .conf / .ovpn file in a client |
|---|---|---|---|
| Difficulty | Low — a couple of taps | Medium — parameters entered by hand | Medium — you need a client and a file |
| Protocols | WireGuard, OpenVPN, IKEv2 or the service's own protocol | IKEv2/IPSec only (Android 12+) | WireGuard or OpenVPN |
| Server choice | List of locations, one tap | One profile — one server | One file — one server |
| DNS leak protection | Usually built in | Depends on the server | Set in the config (DNS line) |
| Kill switch | In-app + system Always-on | System Always-on only | System Always-on |
| Split tunneling | Yes, in the app interface | No | Yes, in the WireGuard client |
| When to choose | Personal VPN for privacy and public networks | Corporate VPN from an administrator | Your own server or a provider with manual setup |
Unless you are required to use a specific corporate profile, install an app. We will still cover the other methods — they are useful for work and for understanding what happens under the hood: every VPN on Android runs through the system VpnService interface, which creates a virtual network adapter (more in our article on TUN and TAP VPN adapters).
Method 1: Install a VPN App from Google Play or an Official APK
This is the recommended path for personal use. It takes a couple of minutes and needs no technical knowledge.
Step 1. Download the official app
Open Google Play, find your VPN provider's app and tap Install. If the provider distributes the app as an APK, download it only from the service's official website — the link is usually in an Apps or Download section. It is critical to make sure this is the genuine app and not a clone: check the developer name, number of downloads, last update date and the address of the site you download from. VPNs are a popular target for fakes that harvest credentials and push ads after installation; how to spot them is covered in our article on malicious VPN apps.
Step 2. Create an account or sign in
Open the app and register or sign in with your existing credentials. If you bought a subscription on the provider's website, use the same login. After sign-in the app is usually ready to connect — servers and protocol are configured for you.
Step 3. Allow the system VPN request
On the first connection Android shows a system “Connection request” dialog: the app asks for permission to set up a VPN connection that will allow it to monitor network traffic. Don't be alarmed by the wording — it is Android's standard warning for any VPN: without access to traffic routing a tunnel is impossible. If the app is official and you trust it, tap OK. Android remembers the permission and won't show the dialog again. One important detail: only one VPN app can be active in a user profile at a time, so granting permission to a new service disconnects the previous one.
Step 4. Choose a server and connect
Tap the big connect button. The app either picks the optimal server itself or offers a list of locations — for maximum speed and minimum ping choose a server close to you (why distance matters is explained in what ping in a VPN is). Once connected, a key icon appears in the status bar — the system indicator that the tunnel is active.
Step 5. Check that the VPN really works
Open the What is my IP page first without the VPN, then with it. The address and country should change to those of the VPN server. If the address hasn't changed, the tunnel isn't fully up — go back to Step 4 or check the troubleshooting table below.
That completes the basic setup. But on Android in particular there are a few more steps without which the VPN will be unstable or won't run around the clock. They are covered below.
Method 2: Manual VPN Setup via System Settings
The manual path is needed when an administrator gave you corporate VPN parameters or you deliberately want a system profile without a third-party app. Mind the version limit: on Android 12 and later only three types are available when creating a profile — IKEv2/IPSec MSCHAPv2, IKEv2/IPSec PSK and IKEv2/IPSec RSA. The old PPTP and L2TP/IPSec types have been removed from the list; on Android 11 and earlier you may still see them, but PPTP has long been insecure and L2TP is slower and harder on the battery. If an old guide asks you to pick “L2TP/IPSec PSK” and your phone has no such option, the system version is the reason — ask your administrator for IKEv2 parameters.
Step 1. Open the VPN section in settings
The path depends on the skin:
- Pixel and stock Android: Settings → Network & internet → VPN.
- Samsung One UI: Settings → Connections → More connection settings → VPN.
- Xiaomi HyperOS/MIUI: Settings → Connection & sharing → VPN.
- Other firmware: type “VPN” into the settings search.
Tap “+” or “Add VPN profile”. If the system asks, set a screen lock (PIN, password or pattern) — without one Android won't store VPN profiles with credentials.
Step 2. Enter the connection parameters
The fields depend on the selected type, but the basics are:
- Name — any profile name (for example, “Work VPN”).
- Type — IKEv2/IPSec MSCHAPv2 (username and password), PSK (pre-shared key) or RSA (certificate). The server administrator decides which one.
- Server address — the domain name or IP issued by the provider or administrator.
- IPSec identifier — the client identifier string; required for PSK, otherwise the connection is rejected.
- IPSec pre-shared key or certificates — for PSK and RSA respectively; install the certificate first via Settings → Security → Encryption & credentials.
- Username and password — for MSCHAPv2.
Step 3. Save and connect
Tap Save — the profile appears in the VPN list. Tap it, enter credentials if needed and tap Connect. The key icon in the status bar confirms the tunnel. If the connection fails, the usual culprits are the wrong authentication type, a typo in the server address, identifier or pre-shared key, or a wrong date and time on the phone: clock drift breaks IKEv2 certificate validation.
Method 3: WireGuard or OpenVPN from a Config File
If you were given a .conf file (WireGuard) or an .ovpn file (OpenVPN) — for example, for your own server or from a provider that supports manual setup — you need a universal client: the official WireGuard app or OpenVPN Connect. Android's built-in client cannot open these files.
- Install the client for the protocol from Google Play.
- Tap “+” and choose “Import from file” or “Scan from QR code” (WireGuard supports both; OpenVPN Connect accepts an .ovpn file).
- Check the tunnel name and save the profile.
- Turn on the tunnel toggle and confirm the system VPN request.
- If the client supports an app list, set exclusions directly in the tunnel settings.
A config file contains a private key, so don't send it through messengers or keep it in shared folders: whoever gets the file can connect as you. Note a LiMP VPN limitation as well: the service works through its own apps and does not issue config files for manual setup, so this method isn't needed for it.
Always-On VPN and Block-Without-VPN: Android's System Kill Switch
This is perhaps Android's most useful and underrated security feature. Always-on VPN (available since Android 7) makes the system keep the tunnel up at all times: it starts when the device boots and is restored after a drop. The companion toggle “Block connections without VPN” turns this into an OS-level kill switch: while the tunnel is down, the system lets no traffic out at all.
Why it matters: when a VPN drops (switching Wi-Fi↔mobile data, losing coverage, a server failure), an ordinary client lets traffic into the open network for a fraction of a second, and your real IP and DNS queries can leak in that window. The system block guarantees there is no such window: no tunnel — no internet.
How to enable it: open Settings → Network & internet → VPN, tap the gear next to the app or profile and turn on “Always-on VPN”, then “Block connections without VPN”. The gear with these toggles appears only if the app supports always-on mode. System Always-on is more reliable than an app's own kill switch: it takes effect even before the app starts after a reboot. A caveat: with blocking on, if the server is unreachable you will have no internet until you connect to a working server or turn the option off. That is the price of security, and it is usually worth it.
Split Tunneling: Which Apps Go Through the VPN
Android lets a VPN app use the VpnService API to specify which programs go into the tunnel and which go direct. The mechanism has two modes — “only selected apps through the VPN” (allowed list) or “all except selected” (exclusion list); you cannot set both at once. In practice you configure it in the VPN app, in a section called App filtering or Split tunneling.
- Banking apps. Bank anti-fraud systems sometimes flag a login from an unfamiliar IP as suspicious. Taking the bank out of the VPN avoids extra checks and card blocks.
- Local services. Delivery, taxi, maps and government services work by location and respond faster from your usual address — it is convenient to let them go direct.
- Heavy traffic. Browser and messengers through the VPN, game updates and cloud backups around it, so they don't load the tunnel.
- Work profile. On devices with a work profile (Android Enterprise) the VPN can apply only to work apps, leaving personal ones untouched.
For privacy, “everything through the VPN except explicit exclusions” is usually safer: a newly installed app is protected straight away. “Only selected apps” is handier when two or three programs need the VPN and the rest of the traffic should flow as usual.
The Main Android Problem: Battery Optimization Kills the VPN
If your VPN on Android turns itself off in the background, overnight or after the screen locks, aggressive firmware battery saving is almost certainly to blame. To extend battery life, manufacturers (especially Xiaomi, Huawei, Samsung, OPPO, OnePlus, vivo) forcibly put background apps to sleep or unload them — and the VPN client gets caught up in it. This is the most common reason for “the VPN works, then it doesn't” complaints.
The fix is to take the VPN app out of power management. Stock Android has the basic step: Settings → Apps → [your VPN] → Battery → Unrestricted. On branded skins that isn't enough — extra permissions are needed:
- Xiaomi (MIUI/HyperOS): Battery saver → “No restrictions”; enable Autostart; lock the VPN in the recent apps list with the padlock icon.
- Huawei (EMUI/HarmonyOS): Settings → Battery → App launch → find the VPN → turn off “Manage automatically” and enable “Auto-launch”, “Secondary launch” and “Run in background”.
- Samsung (One UI): Device care → Battery → Background usage limits → remove the VPN from sleeping apps and add it to “Never sleeping apps”.
- OPPO/OnePlus/vivo: allow background activity and auto-launch, and turn off “smart” power saving for the VPN app.
- Stock Android (Pixel): “Unrestricted” in the Battery section plus system Always-on VPN is usually enough.
Exact item names change between firmware versions; if you can't find an item by the path above, search settings for “autostart” and “battery”. The most reliable cure for unloading is the system Always-on VPN from the previous section: the OS itself brings it up. The “Always-on + battery exemption” combination solves the problem on virtually every firmware.
Google Play or APK: Where Is It Safer to Install a VPN
Google Play checks apps, provides automatic updates and confirms the developer's signature. But an APK from the provider's official website is also a normal route: many services, LiMP VPN included, distribute their Android app this way to ship updates without store delays. The danger is not the APK format but the source: aggregators, mirrors and builds from random channels.
How to install an APK on Android 8 and later:
- Download the file from the service's official website — check the address in the browser bar.
- Open the downloaded file. Android will offer to allow installs from this source: Settings → Apps → Special app access → Install unknown apps → choose your browser or file manager → Allow.
- Go back and tap Install. Google Play Protect scans the file before installation.
- After installing, revoke the permission from the browser so random downloads can't install themselves.
- Don't give the VPN app unnecessary permissions: it doesn't need access to contacts, SMS or the microphone.
- Never install “mods” or “premium-unlocked” versions of paid VPNs — they are a typical malware distribution channel.
- Keep Google's new rules in mind: mandatory developer verification is being introduced on certified devices, including for apps installed from APKs. What it changes for users is explained in our article on Android developer verification.
DNS and IPv6 Leaks on Android: How to Check
Even with the VPN active, some requests can bypass the tunnel — that is a leak. The two classic ones on Android are DNS leaks (queries go to the carrier's resolver and reveal which sites you open) and IPv6 leaks (if your carrier has IPv6 enabled and the VPN tunnels only IPv4, your real IPv6 address is visible directly).
- Use an app that tunnels DNS itself through its own resolver and blocks leaks.
- If there is a “block IPv6” or “IPv6 through the tunnel” option, turn it on.
- Don't confuse this with the system Private DNS feature (Settings → Network & internet → Private DNS): it encrypts DNS queries with DNS over TLS but doesn't hide your IP and doesn't replace a VPN. If sites stop loading with the VPN on, try setting Private DNS to Automatic — a hard-coded third-party resolver sometimes conflicts with the tunnel's DNS.
- After connecting, open the IP check: the visible address and country should match the VPN server, not your carrier.
If the check shows your real IP or the carrier's DNS, the VPN isn't fully configured and you have no privacy. What exactly your carrier sees without a tunnel is covered in how a VPN protects you from ISP tracking.
Which Protocol to Choose on Android
The app will most likely offer a choice of protocol. On a phone three things matter: speed, battery use and how quickly the connection recovers when switching between Wi-Fi and mobile data — which on a smartphone happens constantly.
| Protocol | Where it is available on Android | Strengths | Limitations |
|---|---|---|---|
| WireGuard | Provider apps, WireGuard client | High speed, battery-friendly, fast roaming between networks | Not in the built-in client |
| OpenVPN | Provider apps, OpenVPN Connect | Mature, maximum server compatibility | Slower and heavier on the battery |
| IKEv2/IPSec | Android built-in client, apps | Works without third-party software, handles network changes well | Less flexible, depends on server settings |
| PPTP, L2TP/IPSec | Older Android versions only | — | Obsolete; PPTP is insecure; removed in Android 12+ |
If the app offers an Auto mode, leave it on: the service will pick a protocol for the network. Switch manually only if the connection won't establish or speed is noticeably lower than usual.
Notification, Work Profile, and Auto-Connect
Once connected, Android shows a key icon and a persistent VPN notification. You can't hide it completely — it is an OS security requirement: the user must see that traffic is being redirected. You can only lower the notification's priority in the app's notification settings. If your phone is managed by an employer through MDM (Android Enterprise), the administrator can enforce Always-on VPN for work apps; your personal profile stays under your control. The same logic applies to tablets with several users: Android applies the VPN to each profile separately.
A handy habit is to make the VPN switch on by itself on public networks. Many apps can do this: look for Trusted networks or “Connect on unsecured Wi-Fi” in settings. You mark your home network as trusted, and in open hotspots at cafés, hotels and airports the tunnel comes up automatically. Separately, turn off auto-connect to open Wi-Fi in system settings and keep randomized MAC addresses on for other people's networks — why that matters is explained in our article on MAC address tracking over Wi-Fi.
How to Toggle a VPN Quickly: The Quick Settings Tile
To avoid opening the app every time, add the VPN to the notification shade. Swipe down from the top of the screen twice, tap the pencil icon (Edit), find your VPN app's tile (many clients add one, WireGuard for example) and drag it into the active area. Now the tunnel turns on and off with one tap. If there is no tile, the app doesn't support one — a home-screen widget or a long press on the app icon will do instead.
How to Turn Off or Delete a VPN on Android
Sometimes you need to switch the VPN off temporarily — for example, to see whether it is what's breaking a website — or remove it for good.
- Turn off temporarily: tap Disconnect in the app, the tile in the shade, or the VPN notification → Disconnect. If “Block connections without VPN” is on, you will lose internet — turn that toggle off first.
- Delete a manual profile: Settings → Network & internet → VPN → gear next to the profile → “Forget VPN” (on Samsung, Delete in the profile menu).
- Uninstall the app: Settings → Apps → [your VPN] → Uninstall. The profile and system permission disappear with it. If Always-on was enabled, check that no leftover blocking mode remains in the VPN section.
Checklist: Setting Up a VPN on Android Correctly
- Installed the official app — from Google Play or as an APK from the provider's website — not a clone or a nameless “free” VPN.
- Confirmed via your IP address that traffic goes through the VPN server.
- Turned on “Always-on VPN” and “Block connections without VPN” (OS-level kill switch).
- Excluded the VPN app from battery optimization and allowed autostart.
- Set up split tunneling if you need to keep a bank or local services outside the VPN.
- Checked there are no DNS or IPv6 leaks.
- Added a VPN tile to Quick Settings.
- Gave the app no unnecessary permissions (a VPN doesn't need contacts, SMS or the microphone).
Troubleshooting Matrix
| Symptom | Likely cause | What to do |
|---|---|---|
| VPN won't connect at all | No internet, server unreachable, wrong date and time | Check internet without the VPN, change server and protocol, enable automatic time |
| Manual profile won't save | The system requires a screen lock to store credentials | Set a PIN or password in security settings |
| No L2TP/PPTP option | Android 12 or later | Ask the administrator for IKEv2/IPSec parameters or use an app |
| VPN disconnects in the background | Battery saving unloads the app | “Unrestricted” battery, autostart, system Always-on |
| Connected, but not working over Wi-Fi | Router or public network restrictions | Compare with mobile data; full breakdown in VPN not working on Wi-Fi |
| Some sites load partially or hang | Packets too large, fragmentation | Change protocol or server |
| Slow speed | Distant server, heavy protocol | Pick the nearest server, switch to WireGuard |
| Can't see a printer, NAS or Chromecast | Local traffic went into the tunnel | Enable “Local network access” in the app or exclude the relevant app |
| Conflict with antivirus | Only one VPN can run at a time | Turn off the antivirus VPN module or its Wi-Fi protection |
| Bank blocks login | Anti-fraud reacts to the IP change | Exclude the bank from the VPN via split tunneling |
| Real IP or DNS leaks | IPv6 outside the tunnel, Private DNS conflict | Block IPv6, set Private DNS to Automatic, enable kill switch |
| VPN notification won't go away | Normal Android behavior | You can only lower its priority |
A VPN on Android with LiMP
The LiMP VPN app for Android (version 8 and later) installs as an APK from the official website and covers the main tasks of this guide without manual settings: protection turns on with one tap, the optimal server is picked automatically, and auto-reconnect kicks in when the connection drops. App filtering lets you keep banking and government services on a direct connection. The service keeps no activity logs, and one account works on 10 devices — besides Android there is a Windows app and a Chrome extension. The list of platforms is on the apps page, subscription terms are on the pricing page. If you are unsure how to pay for any VPN safely, read is it safe to pay for a VPN.
Conclusion
Setting up a VPN on Android is easier than it looks: for personal use, install the official app, allow the system request and connect. A manual profile on Android 12+ means IKEv2/IPSec only and is mostly a corporate scenario, while WireGuard and OpenVPN from a file need a separate client. The key practical advice for Android is to turn on “Always-on VPN” with “Block connections without VPN” and exclude the app from aggressive battery saving; without that, even a good service will silently drop in the background. Then check your IP and make sure there are no leaks — and the setup is done.
