When choosing an Android VPN, first check whether it stays connected with the screen off, then consider routes and protocols. Background settings, battery optimization, and per-app proxying all shape the experience: a site loading while the app is open doesn't mean the VPN will keep working when you switch apps, lock the screen, or change networks.
This guide shows you how to compare performance on your own device. It doesn't provide unverified device rankings or speed test results. Check that the client supports your Android version, then compare its behavior on the same route before and after changing settings. This helps distinguish system restrictions from service-side issues.
Android VPN disconnects: distinguish app shutdowns from connection failures
Most Android proxy clients route traffic through the system VPN service. A VPN icon in the status bar indicates that Android has established the service, but it doesn't guarantee that the remote node is reachable. Problems can occur with the client process, tunnel connection, DNS resolution, or destination website.
If the client notification disappears after you lock the screen and the connection is off when you reopen the app, check background restrictions first. If the notification remains and the connection is still on, but no international sites load, review connection errors, network changes, and DNS results in the logs. If only one app fails, check whether it's excluded from the proxy.
| What you see | Check first | Next step |
|---|---|---|
| Notification and connection disappear after locking the screen | Background process or service is restricted | Adjust battery settings, then retest without changing routes |
| Connection won't recover after changing networks | Stale connection or reconnection issue | Reconnect manually and check whether it works |
| Only some apps can't connect | Per-app list or routing rules don't match | Check whether the app's traffic enters the tunnel |
| App works, but domain won't load | DNS route or resolution issue | Check DNS resolution in the connection logs |
A missing notification is a clue, not proof that the process was shut down. Some systems hide notifications, and some clients display them differently. Record the connection status, app logs, and actual browsing results together rather than relying on the status bar icon alone.
Keep your VPN running in the background: find the right settings for your device
Keeping an Android VPN running doesn't mean turning off every battery-saving feature. A better approach is to relax restrictions only for the client that needs a persistent connection, while leaving other apps' default settings in place. This minimizes disruption and makes it easier to identify which setting helps.
On Android systems close to stock, look for battery settings in the app info screen. If there's an "Unrestricted" or background activity option, enable it for the client. Doze may still affect network activity, so disabling battery optimization doesn't guarantee a continuous connection.
On Xiaomi HyperOS, check the app's battery settings and background autostart. On Huawei and Honor devices, review options such as automatic app management and background activity under app launch settings. OPPO, realme, and OnePlus devices typically have background activity and autostart permissions to check. On vivo and iQOO devices, look for background power management and autostart settings.
On Samsung devices, check background usage limits and whether the client is listed under Sleeping or Deep sleeping apps. Menu names vary by system version, region, and device model. Use the app info screen and search in Settings rather than assuming one menu path works on every device.
- ✅ Allow necessary background activity on the client's app info page and check its battery optimization status.
- ✅ If your system offers autostart management, allow the client to start when needed, then verify what happens after a reboot.
- ✅ Keep connection notifications enabled and avoid force-stopping the client. Clearing it from recent apps isn't a reliable way to disconnect.
- ✅ Change settings for the client only, then retest. Don't loosen background permissions for every app at once.
- ❌ Don't rely on locking the app in Recents as your only way to keep it running; this won't override every system restriction.
Per-app proxying and traffic rules solve different problems
Per-app proxying determines which apps send traffic through the VPN service. Routing rules determine whether connections that reach the client use the proxy, connect directly, or get blocked. These operate at different levels and can't replace one another. If an app is excluded from the VPN service, the client's domain-based proxy rules usually can't route its traffic either.
Clients with per-app settings usually offer modes such as "Proxy selected apps only" or "Bypass selected apps." The exact options and behavior depend on the client. You may need to reconnect the VPN after changing the list. Don't rely on checkmarks alone: reopen the target app and confirm that it can connect.
| Option | Best for | Trade-offs |
|---|---|---|
| Proxy selected apps only | Routing only specific browsers or tools through international routes | Newly installed apps may be excluded by default, so you'll need to maintain the list |
| Bypass selected apps | Most apps need the proxy, while a few local services should connect directly | A long exclusion list makes it easy to miss traffic you intended to protect |
| Apply routing rules to apps inside the tunnel | Using one browser for both local and international websites | More complex to maintain; depends on routing rules, DNS settings, and client capabilities |
If you proxy only your browser, traffic may be handled differently when it opens an external sign-in component, the system download manager, or another app. Work-profile apps may also follow different management policies from apps in your personal profile. After confirming that a page loads, test sign-in redirects, downloads, and links that open in other apps.
Per-app proxying doesn't guarantee lower battery use. Wake-ups, signal strength, data transfer, reconnection frequency, and the client itself all affect battery life. Compare results on your own device instead of assuming that a shorter app list saves power.
Choosing a client and routerecommendations for your needs
For your first setup, choose a client with a clear configuration flow, easy-to-read connection status, and accessible logs. If you need per-app proxying, confirm that the client supports your preferred mode before installing it. If you need to import a subscription, check format and protocol compatibility. An app with VPN in its name won't necessarily import every subscription.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocols or protocol families, and client support varies. Protocol names aren't a reliability ranking. A subscription containing a particular node type doesn't mean your client's core and configuration parser can use it correctly.
Hysteria2 and TUIC use QUIC, so UDP availability and restrictions on your network can affect performance. Other protocols have their own transport and configuration requirements. No protocol is guaranteed to use less battery or be more stable on every Android network. First check that it works, then compare recovery after locking the screen and changing networks.
For routes, direct connection usually means the client connects straight to the service node; a relay adds a forwarding hop; and IEPL refers to a specific dedicated-link arrangement. These terms describe the route or transport, not whether Android will shut down a background app. Route labels alone don't establish latency, congestion, or video performance. Check the route details and test it for your use case.
Import your subscription, then follow the same steps totest
The VPNFresh Android client is available in the user panel. Visit the client downloads page, sign in, and get the client. Subscriptions are also available after signing in. If you use a compatible client, follow the import instructions in the panel instead of reusing configuration files from another platform on Android.
- Check the source and format. Get the subscription from the user panel and import it through the client's subscription or URL import option. If you see a format error, check compatibility first rather than repeatedly editing the link.
- Approve the VPN connection. When connecting for the first time, review Android's VPN connection request. Confirm that the correct app initiated it, then allow the connection. This isn't a website sign-in, and it doesn't share your subscription with other apps.
- Establish a baseline while the app is open. Keep one route selected, open a website you use regularly, and note the client's status and any error messages. Confirm that it works in the foreground before testing background behavior.
- Test after locking the screen. Keep the network unchanged, lock the screen, then wake the device and check the connection and target app. Next, change only the background permissions and repeat the test. Note whether you still need to reconnect manually.
- Test network changes separately. Switch between Wi-Fi and mobile data, then check whether the client recovers. If reconnecting manually works, record that result rather than immediately concluding there's a service-side fault.
- Check per-app settings and your exit IP. Use the browser you plan to proxy to open the IP check page, then test the actual features of apps you've excluded to confirm that the settings behave as expected.
Record results using notes such as "works in foreground," "recovers after screen lock," "recovers after network change," and "target app connects." Include the client and system versions if useful. Don't treat impressions gathered on different networks or in different locations as a like-for-like comparison.
Once the exit route works, check DNS and battery use
If the IP check page shows the expected region, that confirms only that this browser request used the expected exit route. It doesn't prove that every app or DNS query used the same path. Per-app settings, the browser's Secure DNS, Android's Private DNS, and the client's own DNS strategy can all affect the result.
A DNS leak means DNS requests are taking an unexpected route; the location of the resolver alone isn't enough to identify one. Public DNS services may use nearby points of presence, and a test site can only observe requests made during the test. Start by defining the expected route, then review client logs and DNS test results. Entering a random DNS address doesn't prove the issue is fixed.
If battery use increases noticeably, first check for frequent reconnects, weak signal, or long periods of data transfer. Android may attribute some VPN-routed network activity to the client, so its share of battery usage doesn't directly measure encryption overhead. For a fair before-and-after comparison, keep the network, screen use, and app activity as similar as possible.
When contacting support, include your device model, system version, client source, network type, steps that trigger the issue, and a redacted log. Open a ticket through the user panel from the contact page; this makes troubleshooting easier than simply reporting that your Android VPN keeps disconnecting.