How to Set Up a VPN on Android: Step-by-Step Guide

TL;DR: The easiest way to set up a VPN on Android is to install your provider's official app from Google Play, allow the system VPN-connection request, and tap Connect. Unlike iOS, Android does more: a system-level Always-on VPN with a "Block connections without VPN" option (a true OS-level kill switch), full per-app split tunneling via VpnService, and work-profile support. The biggest hidden gotcha is aggressive battery optimization on Xiaomi, Huawei, Samsung and similar skins, which kills VPN apps in the background — you must disable it manually. Below: step-by-step Google Play setup, manual IKEv2/L2TP configuration, Always-on tuning, app filtering, DNS/IPv6 leak protection, and a troubleshooting matrix. If you're still figuring out what a VPN is, start with what a VPN is in simple terms.

Two Ways to Set Up a VPN on Android: Which to Choose

There are two fundamentally different ways to get a VPN running on Android. The first is to install your provider's ready-made app from Google Play: it creates the VPN profile, manages keys, switches servers and protocols, runs modern WireGuard, and updates automatically. The second is to add a VPN by hand through system settings, entering the server address, protocol type (IKEv2, L2TP/IPSec), and credentials. The manual route is mainly for corporate VPNs assigned by an administrator.

For the vast majority of users, the right choice is the app. Android's built-in VPN client has historically not supported WireGuard or OpenVPN: it offers only PPTP (outdated and insecure — don't use it), L2TP/IPSec, and IKEv2/IPSec. So manual setup gives you IKEv2 at best — a solid protocol, but without the flexibility and speed WireGuard delivers in an app. On top of that, an app reconnects automatically, protects against DNS leaks, provides a kill switch, and picks the nearest server, while a manual profile does none of this.

Unless you're required to use a specific corporate profile, install the app. We'll still cover manual setup — it's useful for work and for understanding what's happening under the hood.

Method 1: Install a VPN via the Google Play App

This is the recommended path for personal use. It takes a couple of minutes and requires no technical knowledge.

Step 1. Download the Official App

Open Google Play, search for your VPN provider's app, and tap "Install." It's critical to confirm this is the genuine official app and not a clone: check the developer name (it should match the provider company), the rating, the download count, and the last-updated date. The store is a popular target for fakes that masquerade as well-known services and harvest credentials right after install. Avoid no-name "free VPNs" with a handful of reviews: a free VPN makes money by selling your traffic, which directly contradicts the whole idea of privacy.

Step 2. Create an Account or Sign In

Open the app and sign up or sign in with existing credentials. If you subscribed on the provider's website, use the same login. After signing in, the app is usually ready to connect immediately — servers and protocol are already set up for you.

Step 3. Allow the System VPN Request

On the first connection, Android shows a system dialog along the lines of: "Connection request. The app is requesting permission to set up a VPN connection that allows it to monitor network traffic." Don't be alarmed by the "monitor traffic" wording — this is Android's standard warning for every VPN: it tells you the app will gain access to traffic routing (without which a VPN is impossible). If the app is official and you trust it, tap "OK." Android remembers this permission, and the dialog won't appear on subsequent connections.

Step 4. Pick a Server and Connect

Tap the large connect button. The app will either automatically pick the optimal server or offer a list of locations — for maximum speed choose a server geographically close to you, for bypassing regional restrictions choose one in the needed country. After connecting, a key icon appears in the status bar at the top of the screen: that's Android's system indicator confirming the tunnel is active and all traffic is going through the VPN.

That completes the basic setup. But on Android specifically, there are a few more important steps without which the VPN will run unreliably or won't stay on around the clock. They're covered below.

Method 2: Manual VPN Setup via System Settings

The manual route is needed when you've been given corporate VPN parameters or you deliberately want a system profile without a third-party app. Note the limitation: Android's built-in client supports only IKEv2/IPSec and L2TP/IPSec — no WireGuard or OpenVPN. So manual setup makes sense for compatibility with a corporate server, not for privacy and speed.

Step 1. Open the VPN Section in Settings

Go to Settings → Network & internet → VPN. The path may differ slightly by manufacturer: on Samsung One UI it's Settings → Connections → More connection settings → VPN, on Xiaomi/MIUI it's Settings → Connection & sharing → VPN, on stock Android (Pixel) it's Settings → Network & internet → VPN. If you can't find the section, use the settings search. Tap "+" or "Add VPN profile."

Step 2. Enter the Connection Parameters

Fill in the profile fields. The exact set depends on the chosen type, but the basics are:

• Name — any profile name (for example, "Work VPN") to tell it apart in the list.
• Type — choose the protocol. Prefer IKEv2/IPSec MSCHAPv2 (or certificate/EAP if your admin requires it). Use L2TP/IPSec only if the server doesn't support IKEv2. Never choose PPTP — it has been broken for years.
• Server address — the domain name or IP given by your provider or administrator.
• IPSec identifier / pre-shared key — enter the pre-shared key you were given, if required.
• Username and password — your credentials.

Step 3. Save and Connect

Tap "Save." The profile appears in the VPN list. Tap it, enter credentials if needed, and tap "Connect." A key icon in the status bar confirms the tunnel is up. If the connection fails, it's most often the wrong protocol type, a typo in the server address or pre-shared key, or the server expecting a different authentication method — double-check your administrator's instructions.

Always-On VPN and Block-Without-VPN: Android's System Kill Switch

This is arguably Android's most useful and most underrated security feature. Always-on VPN forces the system to keep the VPN connected at all times: the connection comes up automatically when the device boots and is restored after any drop. The companion option "Block connections without VPN" turns it into a full OS-level kill switch: until the tunnel is active, the system lets no traffic out to the network at all. The iPhone has no equivalent to this hard system-level block.

Why it matters: when a VPN drops (Wi-Fi↔mobile switch, leaving coverage, a server glitch), an ordinary client leaks traffic onto the open network for a fraction of a second, and in that window your real IP and DNS queries can leak. The system kill switch guarantees there's no such window: no tunnel means no internet. For the full mechanics, see what a kill switch is in a VPN.

How to enable it: go to Settings → Network & internet → VPN, tap the gear icon next to the VPN profile, and enable "Always-on VPN," then "Block connections without VPN." For third-party apps, recent Android versions let you designate an app as the "Always-on VPN" — in the same section, select your provider's app. The system Always-on is more robust than an app's own kill switch because it takes effect even before the app itself launches after a reboot. A caveat: with block-without-VPN enabled, if the server is unreachable you'll have no internet until you connect to a working server or disable the option. That's the price of security, and it's usually worth it.

Split Tunneling: Which Apps Go Through the VPN

Android is the only mobile platform with full split tunneling at the system level. Through the VpnService API, the VPN app can specify which traffic to route into the tunnel and which to send directly. In practice this is handled in the VPN app's interface, under "App filtering" or "Split tunneling."

• Banking apps. Some banks flag a login from a "foreign" IP as suspicious. Routing the bank outside the VPN (or keeping it on a server in your own country) avoids unnecessary anti-fraud triggers.
• Local services. Delivery, taxi, maps, and government services are often geo-based and respond faster from a local IP — it's convenient to route them directly.
• Streaming and privacy. Browser and messengers go through the VPN, while heavy local traffic (like game updates) bypasses it so as not to load the tunnel.
• Work profile. On devices with a work profile (Android Enterprise), the VPN can apply only to work apps, leaving personal ones untouched.

There are two modes: "route only the selected apps through the VPN" (allow-list) and "route everything except the selected apps" (deny-list). For privacy it's usually safer to use "everything through the VPN, except explicit exceptions," so you don't accidentally leave a new app unprotected.

The Main Android Problem: Battery Optimization Kills the VPN

If your VPN on Android disconnects on its own in the background, overnight, or after the screen locks — aggressive battery saving in your phone's firmware is almost certainly to blame. To extend battery life, manufacturers (especially Xiaomi, Huawei, Samsung, OPPO, OnePlus, vivo) forcibly "sleep" or unload background apps — and the VPN client gets caught in the crossfire. This is by far the most common cause of "the VPN works sometimes, but not always" complaints.

The fix is to take the VPN app out from under power management. The basic step exists on stock Android: Settings → Apps → [your VPN] → Battery → Unrestricted. But on vendor skins that's not enough — you need extra permissions:

• Xiaomi (MIUI/HyperOS): Battery saver → "No restrictions"; then enable "Autostart" and set "Background activity control" to "No restrictions"; in recent apps, "lock" the VPN with the lock icon so the system won't unload it.
• Huawei (EMUI/HarmonyOS): Settings → Battery → App launch → find the VPN → turn off "Manage automatically" and manually enable "Auto-launch," "Secondary launch," and "Run in background."
• Samsung (One UI): Battery and device care → Battery → Background usage limits → remove the VPN from "Sleeping apps" and add it to "Never sleeping apps."
• OPPO/OnePlus/vivo: in battery settings allow background activity and autostart, and disable "smart" power saving for the VPN app.
• Stock Android (Pixel): "Unrestricted" in the app's Battery section is usually enough; additionally use the system Always-on VPN, which survives unloading.

The most reliable "cure" for unloading is the system Always-on VPN from the previous section: it's brought up by the OS itself. The combination of "Always-on + battery-optimization exemption" solves the problem on practically every skin.

Google Play or APK: Where Is It Safer to Install a VPN

In most cases, install the VPN from Google Play: the store vets apps, provides automatic updates (important for closing vulnerabilities), and verifies the developer's signature. Sideloading an APK is justified only in two situations: the provider's app isn't available in your Google Play region, or you're installing it on a device without Google services. If you can't avoid an APK:

• Download the APK only from the provider's official website, not from aggregators or "mirrors."
• Where possible, verify the checksum/signature if the provider publishes one.
• Keep Play Protect app scanning on — it scans sideloaded APKs too.
• Don't grant the VPN app excessive permissions: a VPN doesn't need contacts, SMS, or microphone access.
• Never install "mods" or "premium-unlocked" versions of paid VPNs — that's a classic malware distribution channel.

DNS and IPv6 Leaks on Android: How to Check

Even with the VPN active, some requests can escape the tunnel — this is called a leak. Two classics on Android are DNS leaks (DNS queries go to your ISP instead of through the VPN, revealing which sites you open) and IPv6 leaks (if your carrier has IPv6 enabled but the VPN only tunnels IPv4, your real IPv6 address is exposed directly).

• Use an app that tunnels DNS itself through its own resolver and blocks leaks — modern WireGuard clients do this by default.
• If settings include a "block IPv6" or "IPv4-only through the tunnel" option, enable it, or choose a provider with full IPv6 support inside the tunnel.
• Don't confuse this with the system "Private DNS" (DNS over TLS) feature: it encrypts DNS but doesn't route it to your VPN provider; with the VPN active, rely on the tunnel's own DNS.
• After connecting, check the result on a leak-test site: your visible IP and country should match the VPN server, and your DNS should not be your carrier's.

For a step-by-step method to test and fix this, see the dedicated guide on the DNS leak test and fix. If the test shows your real IP or your carrier's DNS, the VPN isn't fully configured and there's no privacy.

Which Protocol to Choose on Android

In the app you'll most likely be offered a protocol choice. For Android, WireGuard is optimal: it's faster than OpenVPN and IKEv2, gentler on the battery (fewer CPU wakeups), and reconnects faster when switching Wi-Fi↔mobile — which happens constantly on a phone. Why it's so good is explained in the breakdown of the WireGuard protocol.

• WireGuard — the default choice: speed, battery, and stable roaming between networks.
• OpenVPN — when you need maximum compatibility or disguise as ordinary TLS traffic on filtered networks.
• IKEv2/IPSec — the only decent option for manual system setup; it handles roaming well but usually loses to WireGuard in an app.
• PPTP — don't use it: the protocol is outdated and insecure.

Notification, Work Profile, and Auto-Connect

Once the VPN connects, Android always shows a key icon and a persistent "VPN active" notification. You can't hide it — it's a security requirement of the OS: the user must be able to see that their traffic is being redirected. You can only lower the notification's priority, but the system keeps the key icon. If your phone is managed by an employer via MDM (Android Enterprise), the administrator can force an Always-on VPN for work apps that you can't turn off; the personal profile stays under your control, and you're free to install your own personal VPN for personal apps separately.

A handy habit is to set the VPN to turn itself on in public networks while staying out of the way at home. Many apps do this: settings include "Trusted networks" or "Enable VPN on insecure networks." You mark your home and work networks as trusted, and in open hotspots in cafes, hotels, and airports the VPN turns on automatically. This closes the classic error "forgot to turn the VPN on in someone else's Wi-Fi" — for the risks, see public Wi-Fi security. Separately, it's worth disabling your phone's auto-connect to open Wi-Fi in system settings, so the device won't silently latch onto rogue access points with a familiar name.

Checklist: Setting Up a VPN on Android Correctly

• Installed the official app from Google Play (verified the developer and rating), not a clone or a "free" VPN.
• Selected the WireGuard protocol for speed and battery savings.
• Enabled the system Always-on VPN and "Block connections without VPN" (an OS-level kill switch).
• Took the VPN app out from under battery optimization and allowed autostart (especially on Xiaomi/Huawei/Samsung).
• Configured split tunneling if you need to route your bank or local services outside the VPN.
• Verified no DNS or IPv6 leaks on a test site after connecting.
• Confirmed the key icon appears on connect and disappears on disconnect.
• Didn't grant the app excessive permissions (a VPN doesn't need contacts, SMS, or microphone).

Troubleshooting Matrix

• The VPN won't connect at all. Check the internet without the VPN, switch the server and protocol (WireGuard ↔ OpenVPN), re-grant the system VPN permission, and check the phone's date and time (a clock out of sync breaks IKEv2 certificates).
• The VPN disconnects in the background. Take the app out of power saving, enable autostart, and turn on the system Always-on VPN.
• Slow speeds. Choose the nearest server, switch to WireGuard, and check whether split tunneling or an antivirus is interfering.
• Conflict with an antivirus/firewall. A device can have only one active VPN profile — temporarily disable a third-party antivirus with a VPN/firewall feature to diagnose.
• The bank blocks login. Choose a server in your own country, don't change it mid-session, or route the banking app outside the VPN via split tunneling.
• Your real IP/DNS is exposed. Enable IPv6 blocking, use the tunnel's DNS, and turn on the kill switch.
• The "VPN active" notification won't go away. That's normal and mandatory Android behavior; you can only lower the notification's priority.

A VPN on Android with LiMP

The LiMP app for Android leans on the platform's strengths: WireGuard for speed and battery savings, system Always-on VPN support, app filtering (split tunneling), and a Material Design interface — connecting in a single tap. The service works on iOS and Android, keeps no logs of your activity (billing by OOO LIMP), and costs 100 ₽/month. If you're also setting up a VPN on an iPhone, see the guide on how to set up a VPN on iPhone; you can compare options on the pricing page, the guide on how to choose a VPN in 2026 will help you pick a service, and to understand how a VPN hides your activity from your carrier, see how a VPN protects you from ISP tracking.

Conclusion

Setting up a VPN on Android is easier than it looks: for personal use it's enough to install the official app from Google Play, allow the system request, and connect. But Android specifically gives you what other platforms don't — a system-level Always-on VPN with a hard kill switch, and full per-app split tunneling. Spend five minutes on these settings and the VPN will protect you around the clock. The single most important practical tip for Android is to take the VPN app out from under aggressive battery saving on Xiaomi, Huawei, Samsung and similar skins, and enable the system Always-on; without this, even the best VPN will silently disconnect in the background. Then verify there are no DNS or IPv6 leaks — and you can consider the setup complete. LiMP covers all of these in a single app for 100 ₽/month on iOS and Android; terms are on the pricing page.

FAQ

What's the easiest way to set up a VPN on Android?

Install your provider's official VPN app from Google Play, sign in, allow the system VPN-connection request on first launch (tap "OK"), and tap "Connect." A key icon in the status bar confirms the tunnel is active. It takes a couple of minutes and no technical knowledge — the app manages servers, protocol, and leak protection for you.

Why does my VPN keep disconnecting on Android?

Almost always it's the firmware's aggressive battery optimization unloading background apps. The fix: set the app's battery mode to "Unrestricted," enable autostart (separate items on Xiaomi/Huawei/Samsung), and turn on the system Always-on VPN — it's brought up by the OS and doesn't depend on the app being unloaded.

What is Always-on VPN on Android, and should I enable it?

Always-on VPN forces the system to keep the tunnel up at all times and restore it after a drop, while "Block connections without VPN" cuts off the internet entirely until the tunnel is active — a system kill switch. Enable it if you want 24/7 protection with no leak window. It's set under Settings → Network & internet → VPN → the gear next to the profile.

Is it safe to install a VPN from an APK instead of Google Play?

Google Play is safer: the store verifies the signature and provides auto-updates. An APK is justified only if the app isn't available in your region or the device has no Google services. In that case, download the APK only from the provider's official website, grant no excessive permissions, and never install "mods" of paid VPNs — that's a common malware channel.

Can I route only certain apps through the VPN on Android?

Yes — Android is the only mobile platform with full system-level split tunneling. In the VPN app's settings ("App filtering" / "Split tunneling"), choose which apps go through the tunnel and which go directly. This is handy for routing your bank or IP-sensitive local services outside the VPN.

Which VPN protocol is best for Android?

WireGuard is the optimal choice: it's faster than OpenVPN and IKEv2, gentler on the battery, and reconnects faster when switching between Wi-Fi and mobile, which happens constantly on a phone. OpenVPN is used for compatibility and traffic disguise, IKEv2 for manual system setup. PPTP should not be used — it's outdated and insecure.