How to Use a VPN on Android: Complete Guide from Scratch

Using a VPN on Android comes down to one five-step path: install the client, import the subscription, grant system VPN permission, add the app to the battery whitelist, and confirm it actually works. The big difference from desktop sits in the middle three steps — the system owns the connection, so every client has to be authorized once. A denied permission, a cleared background process or an aggressive battery policy all end up looking the same: you tap Connect and nothing happens. Below, the five steps in order, with what to tap, what you should see and what comes next, followed by per-brand settings paths and a troubleshooting order.

How Android Takes Over VPN Connections at the System Level

Android has shipped the VpnService interface since 4.0: a client app uses it to create a virtual network interface, route device traffic into its own tunnel according to rules, and forward it to a remote node. Because this is a public system capability, setting up a VPN needs neither root nor a custom ROM — the trade-off is that authorization happens at the system layer, not inside the app.

That produces three fixed behaviors. Learn them first and you'll cut your troubleshooting time in half:

• The prompt on connect is a system dialog, not the app's own popup. It states that this is a connection request and lists the apps whose traffic will be routed, and you have to allow it manually.
• Only one VPN can be active at a time. If another client or a built-in system VPN was already running, the new connection either replaces it or fails outright.
• The tunnel is only up when a key or shield icon appears in the status bar. If the app says Connected but the status bar shows no icon, the permission almost certainly hasn't been granted.

Android also lets each app implement protocols itself, so the same subscription link can be imported into different clients; iOS uses NetworkExtension instead, and its settings aren't interchangeable with Android's. Across platforms the subscription link can be reused, but each client has to be installed separately.

Step 1: Install a Client and Get Your Subscription Link

Start by picking up an Android client from the beginner's guide or the download page, then go back to your account and copy the subscription link. Don't reverse the order: the link is tied to your account, so signing in first and copying after avoids grabbing one that has already been reset.

1. Open the download page, choose Android, get the installer and install it. If the system warns about apps from unknown sources, you'll need to grant your browser or file manager install permission once.
2. Sign in with your username and password. Registration here doesn't require an email address — a username and password are enough. Precisely because there's no email for recovery, it's worth storing the account in a password manager.
3. Copy the subscription link from the account page. It's a string starting with https and works like an account credential — don't paste it into public groups or send screenshots of it.
4. Note the plan capacity while you're there; you'll want it as a reference when checking data usage later. Monthly plans: ¥9.9 for 60GB, ¥18 for 250GB, ¥28 for 500GB, with data resetting every month on the activation date.

Step 2: Import the Subscription and Choose a Node

The subscription link isn't a node itself but an address: the client requests it and gets back a node list (commonly a Base64-encoded list, or a YAML / JSON config). That's why switching nodes doesn't mean copying the link again — one Update Subscription in the client pulls the latest routes the server publishes.

The usual import path: find Subscription or Config on the client's home screen → paste the link → save → update. After a successful update the node list goes from empty to dozens or hundreds of entries, grouped by region. An auto-update interval of around 12 hours works well — frequent enough to stay current, infrequent enough not to hammer the server.

The protocol is just the transport — no need to study each one

Every route in the subscription is labeled with a protocol; six are common. They differ mainly in transport layer and handshake, and their impact on day-to-day use is far smaller than the quality of the route itself.

When a connection fails, switching protocol often works faster than switching nodes: QUIC-based routes will always fail on networks that block UDP, so move back to a TCP-based one.

Choose by route type first, latency second

Clients usually have a latency test button, and lower numbers sort to the top. But latency reflects a single handshake round trip — not peak-hour congestion, and certainly not bandwidth. A more reliable order is: route type first, then region, then latency.

• Direct: the client connects straight to an overseas node. Shortest path, but it uses public international egress and tends to wobble at peak hours.
• Relay: connect to a relay server first, then exit abroad from there. One extra hop buys you a way around congested segments, and stability is usually better.
• IEPL dedicated line: an end-to-end private link that avoids congestion points on public egress. Latency isn't necessarily the lowest, but variation is minimal — good for long sessions.

Pick regions by purpose: for international sites and everyday services, choose nearby ones such as Japan, Hong Kong or Singapore; for services tied to a specific country, switch to that country. Don't hop countries just to look fast — some services trigger extra verification when the login IP keeps changing. The full list is on the global nodes page.

While we're at it, here are the fixed service parameters you'll want when checking data usage and refunds later:

Step 3: Grant System Permission

With a node selected, tap Connect. The first time, a system dialog always appears — the title is something like Connection request, and the body explains that the app will take over network traffic. Tick the trust option and confirm; the dialog closes and a key icon appears in the status bar.

1. Tap Connect and the system dialog appears — check that the app name listed in it is the right one.
2. Tick I trust this application or the equivalent option, then tap OK.
3. Back in the client, the status should read Connected, and a key or shield icon appears in the status bar.
4. Open a browser and visit an international site to confirm it loads normally.

If you tapped Cancel by mistake, or the system no longer shows the dialog, grant it manually: Settings → Network & internet → VPN → find the app → turn authorization on. You can also clear the app's data and reconnect to make the dialog appear again.

Should you turn on Always-on VPN?

The system VPN settings have two advanced switches: Always-on VPN, and Block connections without VPN (some builds call it VPN only). The first reconnects automatically after boot or a network change; the second is stricter — nothing gets through while the tunnel is down.

For long-term use, Always-on saves you manual reconnects; during troubleshooting, leave it off, otherwise 'no internet' may just be the policy blocking traffic rather than a route failure. Decide once all five steps check out.

Step 4: Add the App to the Battery Whitelist So It Isn't Killed in the Background

Android's battery policies restrict background activity once the screen locks. A VPN client needs to hold a long-lived connection in the background, and once the system freezes it the symptoms are: drops a few minutes after locking, the notification icon disappears, and it takes a few seconds to come back when you wake the screen. The fix isn't reconnecting over and over — it's adding the client to the whitelist.

There are usually four items to enable. Vendors name them differently, but they mean the same thing:

• Autostart: lets the app launch at boot or when woken in the background.
• Background activity: lets the app keep running in the background without being frozen.
• Battery optimization: set the app to Not optimized or Unrestricted.
• Lock in recents: pull down on (or long-press) the app card in the multitasking view to lock it, so a one-tap clean doesn't kill it.

Where each brand hides these settings

The table below covers the common systems. Menu names and levels shift between versions; if you can't find an item, search the system settings for autostart or battery optimization — that usually gets you there.

The table lists common paths; versions differ, so follow the menus on your device.

Step 5: Verify the Connection Is Working

'Shows connected' and 'traffic actually goes through the node' are two different things and have to be checked separately. The quickest way is three checks: IP, DNS, routing.

1. Check the IP: open any IP lookup page and see whether the country/region and ISP match the node you picked. If they do, egress has switched.
2. Check DNS: open a DNS leak test page and see whether the resolver is also in the node's region. If it still shows your local ISP, DNS requests aren't going through the tunnel.
3. Check routing: open a site in mainland China and an international site. If both work, rule mode is behaving; if the international site won't load, switch to global mode and try again.

DNS leaks deserve their own note. Since Android 9 the system offers Private DNS (DNS over TLS), and it takes priority over DNS settings inside the app. With Private DNS on, name resolution can skip the tunnel even after it's established — the result being an IP that shows up abroad while some sites resolve locally or fail to load. Set Private DNS to Automatic or off, then test again.

Routing Rules: How to Choose Between the Three Modes

Clients generally offer three modes: Global, Rule (auto) and Direct. The only real difference is whether all traffic goes through the tunnel.

• Global: all traffic goes through the node. Good for troubleshooting and one-off access; for daily use it burns extra data, and services in mainland China may slow down or raise risk flags because egress is abroad.
• Rule / auto: splits by domain and IP — traffic to mainland China goes direct, everything else through the node. This is the everyday pick, provided the rule set stays up to date.
• Direct: nothing goes through the node. Useful for turning the proxy off temporarily without disconnecting.

Two practical rules: keep everyday services in mainland China on direct — especially payments, banking and anything tied to real-name verification — so a changing egress IP doesn't trigger anomalies; and pin services that need a stable login session to one node instead of changing countries on every connect.

If routing stops working, check where the rules come from

Rule mode depends on a routing rule set. Once it goes stale, new domains get misjudged: what should go direct goes through the node, and what should go through the node goes direct. Update the rule set along with the subscription, or set the rule source to follow the subscription — that prevents most 'it worked yesterday, today it won't open' cases.

If It Won't Connect, Troubleshoot in This Order

Checking from the outside in beats tapping Connect over and over. Work through the list below item by item.

• ✅ A key icon appears in the status bar and the system VPN settings show connected — permission and tunnel are both fine.
• ✅ The IP lookup shows the same region as the selected node — egress has switched.
• ✅ The DNS test shows a resolver in the node's region — resolution is going through the tunnel.
• ❌ The app says connected but there's no icon in the status bar — permission was denied or revoked by the system; go back to the system VPN settings and grant it again.
• ❌ It drops a few minutes after the screen locks — the battery whitelist isn't complete; check background activity and battery optimization first.
• ❌ It breaks on Wi-Fi but works again on mobile data — that Wi-Fi may block UDP or specific ports; try another route.

If any item fails, work through these in order:

1. Switch to another node, preferably one with a different route type (direct → relay, relay → dedicated line).
2. Switch protocol or transport. QUIC-based routes can't connect on networks that block UDP — go back to a TCP-based one.
3. Switch to global mode to rule out the routing rules.
4. Check that the system time syncs automatically. VMess relies on timestamps, and a large skew fails authentication outright.
5. Turn off Private DNS, or set it to Automatic.
6. Make sure no other VPN is active at the same time, including built-in and enterprise-configured ones.
7. Switch networks (Wi-Fi ↔ mobile data) to tell a route problem from a local network problem.

If it still won't connect after these seven steps, look at the client log. It usually says whether the handshake timed out, authentication failed or DNS resolution failed — three causes with completely different fixes: handshake timeout means change route, authentication failure means check the account and the clock, resolution failure means check DNS settings.

Common Questions

Do I need root to set up a VPN on Android?

No. VpnService is a public system interface that ordinary apps can request, and the user confirms authorization in the system dialog. Root makes no difference to the connection, and flashing a ROM or modifying the system 'for stability' isn't recommended.

How many devices can one subscription cover at the same time?

There's no device limit here — phone, tablet and computer can all be online at once. Data is shared across the account, though, so keep an eye on total usage when you add devices.

Do data packs expire?

No. Data packs last until they're used up and never expire, which suits irregular usage; monthly plan data resets every month on the activation date, and if you upgrade mid-cycle the difference is prorated by remaining days.

Why do I have to authorize again after reinstalling?

VPN authorization is tied to app data. After an uninstall or a data wipe the system treats it as a new app and shows the dialog again. The subscription link stays valid — just import it again.

Apps in mainland China got slower after connecting — is that normal?

In global mode, traffic to mainland China also detours abroad and back, so slower is expected. Switch back to rule mode and let those services go direct.