How to Set Up a VPN on Android (Properly): Always-On, Kill Switch and Split Tunneling

Setting up a VPN on Android takes about five minutes: install the provider's app from the Google Play Store, sign in, tap connect, and grant the one-time connection permission Android asks for. But the settings that actually matter — always-on, kill switch, and per-app split tunneling — live in two different places, and getting them right is what separates a VPN that quietly protects you from one that leaks or keeps dropping.

The two ways Android does VPN, and why you almost always want the app

Android has supported VPNs natively for over a decade, and there are genuinely two routes: install your provider's own app, or key the connection into Android's built-in VPN client under Settings. They sound interchangeable but they are not. For nearly everyone, the provider app is the right call, and the built-in client is a niche fallback for a specific protocol.

The built-in Android VPN client is deliberately minimal. On modern Android (version 12 and later) it supports only IKEv2/IPsec for new connections — the older PPTP and L2TP/IPsec options were deprecated and no longer work. It has no server picker, no WireGuard support, and you have to type in server addresses and shared keys by hand. Provider apps, by contrast, ship WireGuard or a proprietary fast protocol, a one-tap server list, a kill switch inside the app, and auto-connect rules.

• Provider app (recommended): WireGuard/proprietary protocols, thousands of servers, in-app kill switch, split tunneling, auto-connect on untrusted Wi-Fi.
• Built-in Android client: IKEv2/IPsec only, manual server entry, no server list — useful mainly for a corporate VPN or a self-hosted server your admin gave you credentials for.
• Rule of thumb: if your VPN provider has a Play Store app (almost all do), use it. Reach for Settings > VPN only when someone hands you a config and no app.

If you are still choosing a provider, our editor-tested rankings in the best VPN guide break down which apps have the cleanest Android builds, the most reliable kill switches, and the fastest WireGuard implementations. This post assumes you have picked one and want to configure it properly.

Installing from the Google Play Store, step by step

Installation is the easy part, but two details trip people up: making sure you download the real app rather than a look-alike, and understanding the connection-request dialog Android shows the first time. Fake VPN apps that harvest data are a persistent Play Store problem, so verify the developer before you tap install.

1. 1Open the Google Play Store and search the exact provider name. Check the developer field matches the company and that the app has millions of installs and a long review history — not a brand-new listing.
2. 2Tap Install, then open the app and sign in with the account you created on the provider's website (most subscriptions are bought on the web, not via in-app purchase).
3. 3Tap Connect. The first time, Android shows a system dialog: "[App] wants to set up a VPN connection that allows it to monitor network traffic." This is normal and required — it is Android asking permission to route traffic through the app. Tap OK / Allow.
4. 4A small key icon appears in your status bar. That is Android's universal signal that a VPN is active. If you see it, traffic is tunneling.

That connection dialog only appears once per app; Android remembers the grant afterward. If you ever want to revoke it, you can, under the same VPN settings screen we cover below. Before trusting a new connection, it is worth confirming it is actually leak-free — a topic we dig into in our guide to VPN privacy and what a VPN really hides.

Always-on VPN and "block connections without VPN": Android's system kill switch

Here is the single most important thing most Android VPN guides bury: Android has a built-in, OS-level kill switch that works no matter which VPN app you use. It lives in system Settings, not in the app, and it is stronger than any in-app kill switch because the operating system enforces it. Turning it on means no traffic leaves your phone unless the tunnel is up.

There are two linked toggles. Always-on VPN tells Android to keep your chosen VPN connected and to reconnect it automatically whenever the device comes online. Block connections without VPN is the kill switch: it only becomes available once always-on is enabled, and it drops all internet the instant the tunnel fails.

How to turn them on

1. 1Open Settings > Network & internet > VPN. On some phones the path is Settings > Connections > More connection settings > VPN (Samsung) or under an "Advanced" submenu — search "VPN" in the Settings search bar if you can't find it.
2. 2Tap the gear / settings icon next to your VPN app's name (not the app row itself).
3. 3Toggle Always-on VPN on.
4. 4Toggle Block connections without VPN on. This is the kill switch.

One important caveat, because it causes real confusion: Android's system-level "Block connections without VPN" overrides per-app split tunneling. If you enable the OS kill switch, the operating system forces every app through the tunnel and ignores any bypass rules you set inside the VPN app. You get maximum protection but lose the ability to exclude apps — and note it can also block access to local devices like printers and smart TVs. Pick one strategy — total lockdown, or granular split tunneling — not both at once.

Per-app split tunneling: choosing which apps use the VPN

Split tunneling lets you route some apps through the VPN while others connect directly to your normal network. It is one of Android's best features because the VPN can operate at the individual-app level. Banking apps that block VPN IPs, local streaming, or a food-delivery app that needs your real location can all bypass the tunnel while everything else stays protected.

On Android this lives inside your provider's app (look for "Split tunneling," "App exclusions," or "Bypass VPN for selected apps"), typically under settings. You choose one of two modes:

• Exclude selected apps: everything goes through the VPN except the apps you tick. Best default — protect all, poke holes only where needed.
• Only route selected apps: only the apps you pick use the VPN; everything else connects directly. Useful if you only want the VPN for, say, streaming.

A note on the near future: Android 17 is standardizing this with a system-managed split-tunneling screen (via a new ACTION_VPN_APP_EXCLUSION_SETTINGS intent), so when a VPN app is updated to use it, app exclusions will appear in a consistent OS-owned surface rather than each app inventing its own UI. On today's devices the feature still lives in the provider app for most people. Remember the earlier warning: if the OS-level "block connections without VPN" is on, split-tunnel rules are ignored.

Split tunneling is what makes a VPN livable day to day — it is also central to using one for streaming abroad, where you might route Netflix or BBC iPlayer through a foreign server while leaving your local banking and maps apps on the direct connection.

Using your Android VPN to watch shows and sport from anywhere

Once the VPN is set up, one of its most practical uses is regaining access to services that are tied to a region. Streaming libraries and live-sport rights are geo-locked, so connecting to a server in your home country while travelling — or to another country entirely — restores the catalogue you expect. On Android this works exactly the same as at home: connect, pick a server, open the app.

For live events this matters most. Major fixtures are split across broadcasters by territory, so a server in the right country is often the difference between watching and staring at a blackout. Our coverage of the 2026 World Cup and broader sports streaming maps which server locations line up with which broadcasters, and the can I watch tool checks a specific title against your region in seconds.

• Connect first, then open the streaming app — apps cache your location, so launching the VPN afterward can leave you flagged.
• If a service still detects the VPN, clear that app's cache or try a different server in the same country.
• On Android TV the same provider apps exist, so your living-room setup mirrors your phone.

Troubleshooting: VPN keeps dropping, or no internet after connecting

Two problems account for the vast majority of Android VPN complaints: the connection keeps dropping, and "connected but no internet." Both usually have mundane causes — battery optimization killing the app, a protocol mismatch, or a stale DNS state — rather than anything wrong with the VPN itself. Work through these in order and one of them almost always fixes it.

If the VPN keeps disconnecting

1. 1Stop Android from killing the app. This is the number-one cause. Go to Settings > Apps > [your VPN] > Battery and set it to Unrestricted. Aggressive battery savers put the VPN to sleep in the background.
2. 2Enable Always-on VPN (covered above) so Android reconnects automatically instead of leaving you exposed after a drop.
3. 3Switch protocols. If you are on WireGuard and it keeps dropping, try OpenVPN or IKEv2 in the app's settings; if you are on OpenVPN, try WireGuard. Flaky mobile networks favour different protocols.
4. 4Update the app via Play Store > profile icon > Manage apps & devices, and reboot the phone once.

If you connect but have no internet

1. 1Change server. The specific server may be overloaded or down — switch to another location, then back.
2. 2Clear the app cache. Settings > Apps > [your VPN] > Storage > Clear cache. This wipes corrupted temporary data without logging you out.
3. 3Toggle the OS kill switch off temporarily. If "block connections without VPN" is on and the tunnel half-connected, it can leave you with zero internet — turn it off, reconnect cleanly, then turn it back on. This is also why public Wi-Fi login pages sometimes fail to load until you disable it.
4. 4Check for conflicts. Another VPN app, a private-DNS setting, or a mobile antivirus can block the tunnel. Disable them and retest. As a last resort, reset network settings (Settings > System > Reset options > Reset Wi-Fi, mobile & Bluetooth).

Once you have a stable connection, it is worth confirming nothing is leaking around the tunnel. Run a quick check for a DNS leak and a WebRTC leak, and if speeds feel off, our VPN speed test helps you tell a slow server from a slow protocol.

The 60-second Android VPN checklist

If you only remember one thing, make it this sequence. Done in order, it gives you an always-on, leak-resistant VPN with sensible exceptions — the configuration that works for most people most of the time, whether you are protecting public Wi-Fi or unblocking content abroad.

1. 1Install the provider's official app from the Play Store; verify the developer.
2. 2Sign in, connect, and accept the one-time connection permission (look for the key icon).
3. 3In Settings > Network & internet > VPN, tap the gear and enable Always-on VPN.
4. 4Enable Block connections without VPN — OR set up per-app split tunneling in the app, but not both.
5. 5Set the VPN app's battery usage to Unrestricted so it never gets killed.
6. 6Verify with a DNS/WebRTC leak check, then you're done.

For a provider-by-provider look at which Android apps nail all of this out of the box, head back to our best VPN rankings, or compare live subscription prices in the VPN price index before you commit.