An Android VPN can be configured as more than an app you tap at a coffee shop. Android’s always-on capability can start a selected VPN when the device boots and keep it running. An optional lockdown setting can block network connections that do not use the VPN. Together, those controls reduce the brief unprotected windows that occur when a phone changes networks.
The features are powerful, but strict blocking can also interrupt captive portals, local devices, emergency troubleshooting, and apps that the VPN excludes. Configure them deliberately and test over your actual carrier, travel eSIM, Wi-Fi, and hotspot workflow.
What always-on VPN does
Android’s official developer documentation describes always-on VPN as a system feature that can start a VPN service when the device boots and keep it running while the device is on. The operating system manages service lifecycle, while the VPN app remains responsible for the connection to its gateway.
In practical terms, selecting a compatible app as always on tells Android to restore it without waiting for a manual tap. This is valuable after a restart, when moving from Wi-Fi to cellular, or when signal returns after a coverage gap. It does not guarantee that the provider’s server is reachable or that every app is included.
Menu names vary by manufacturer, but the control is commonly found in the network settings under VPN. Tap the settings icon beside the chosen service and look for “Always-on VPN.” Only one service can generally hold the role for a user or profile at a time.
What lockdown mode adds
Lockdown mode blocks connections that do not use the selected VPN. Android warns that the device will have no internet access until the VPN connects. This is the closest system-level equivalent to a strict kill switch for supported configurations.
Use lockdown when exposure outside the tunnel is worse than temporary loss of connectivity. It can be appropriate for sensitive work, unfamiliar networks, and users who prefer an obvious failure. It may be frustrating if the VPN is unreliable, the provider is blocked, or a hotel requires a browser login before the tunnel can connect.
Learn how to disable lockdown locally before travel. A configuration that cannot reach its gateway can otherwise appear to be a broken SIM. Keep support instructions available offline.
Configure always-on and lockdown safely
Begin with a VPN app that connects reliably in ordinary mode. Sign in, choose the automatic protocol, connect to a nearby server, and use the phone for a day. Only then enable always-on. Confirm that the app reconnects after a restart and network change.
Next, enable lockdown if your risk model requires it. Test these scenarios:
- reboot the phone;
- toggle airplane mode;
- switch from home Wi-Fi to mobile data;
- move between two SIM or eSIM data profiles;
- join a network with a captive portal;
- let the phone sleep for ten minutes;
- use a personal hotspot; and
- temporarily lose signal.
After each transition, verify public IP and DNS behavior. Look for clear notifications when the tunnel is unavailable. If an app can still reach the internet outside the expected route, review split tunneling and system exemptions.
Dual SIM and eSIM behavior
A dual-SIM Android phone may keep two lines enabled while selecting one for mobile data. The VPN operates above the active data connection. Changing the data SIM should trigger a reconnect rather than require a new VPN subscription.
Device makers implement dual-SIM behavior differently. Some phones switch data automatically during calls or weak coverage; others require a manual choice. Automatic switching can create a short path change, so test with always-on and lockdown enabled. If continuity matters more than convenience, disable unneeded automatic switching.
For a travel eSIM plus VPN, install the profile according to provider timing, label it, select it for data, and follow the APN and roaming instructions. Then verify the VPN on cellular with Wi-Fi turned off. Do not delete an eSIM as an early troubleshooting step because the QR code may be single use.
Split tunneling and excluded apps
Split tunneling lets selected apps bypass the VPN or sends only selected apps through it. The feature can improve compatibility with local banking, casting, or workplace services. It also creates exceptions that are easy to forget.
Android VPN apps may implement split tunneling through allowed or disallowed application lists. Review the list after app updates and phone migrations. Under lockdown, behavior can depend on how the VPN app and system define excluded traffic. Test every excluded app rather than relying on a label.
For a privacy-first configuration, begin with all apps included. Add an exception only when you understand why it is necessary. Document it in a note so a future troubleshooting session does not mistake the bypass for a leak.
Private DNS and VPN DNS
Android offers a Private DNS setting that can use DNS over TLS with a named provider. Many VPNs also supply DNS resolvers inside the tunnel. Combining both can work, but it can also create connection or leak-test confusion.
Follow the VPN provider’s recommendation. If the app expects to manage DNS, start with Android Private DNS set to automatic. Then run DNS tests. If you use a custom Private DNS hostname, confirm that requests remain protected and that the VPN’s filtering features still function.
DNS is only one part of the path. An IP address can be protected while browser features, app telemetry, or account logins reveal other information. Evaluate the complete device rather than treating one green test result as proof of anonymity.
Captive portals and local networks
Hotels, aircraft, cafés, and conference venues often require a captive portal login. Strict lockdown may prevent the portal from loading because the VPN gateway is unreachable until the network authorizes the device.
A safe workflow is to confirm the network name, temporarily pause strict blocking, complete the minimal portal login, and immediately reconnect. Avoid entering sensitive credentials into a portal reached through an unexpected certificate warning. Forget the network after use if you do not want automatic reconnection.
Local devices such as printers, casting receivers, smart-home hubs, and in-vehicle systems may also require LAN access. Some VPN apps offer a local-network toggle. Enable it only when needed and understand that local traffic may not follow the remote tunnel.
Hotspot and tethering coverage
Android hotspot behavior varies by phone and VPN app. Traffic from a tethered laptop may bypass the phone’s VPN even when the handset itself is protected. Some apps support tethering explicitly; some require root or advanced configuration; others do not.
Test from the connected device. Compare its public IP and DNS results with the phone. For dependable laptop protection, install the VPN on the laptop or use a travel router with a VPN client. Also verify that the mobile plan permits hotspot use and that it does not impose a separate data cap.
When using USB tethering, secure the computer as if it were connected directly to the internet. A phone tunnel is not a replacement for host firewall, updates, and endpoint protection.
Battery optimization and background restrictions
Aggressive battery management can stop or delay VPN apps on some Android devices. Always-on should help the system restore the service, but manufacturer-specific optimization may still affect notifications, background work, or reconnect speed.
Follow the provider’s device-specific guidance before disabling broad battery protections. Exempt only the VPN app if needed. Check whether a “sleeping apps,” “adaptive battery,” or “background usage” feature is interfering. Keep the app and operating system updated.
A VPN that constantly reconnects can consume power and data. Try a nearby server, automatic protocol, and clean network configuration. Remove abandoned VPN, firewall, ad-blocking, and DNS apps that compete for Android’s VPN slot.
Work profile and managed-device considerations
Android Enterprise can apply always-on VPN to a work profile or fully managed device. An employer may route work apps through a corporate gateway while personal apps use another path. Lockdown and per-app rules can be enforced by policy.
Do not remove a managed configuration without authorization. Corporate VPNs are designed to protect organizational resources and may include monitoring. Read workplace privacy notices and keep personal activity outside the work profile when appropriate.
A personally installed VPN may not cover the managed profile, or the work VPN may prevent a second full-device service. Ask the administrator which traffic is protected and which support process to use abroad.
A disciplined troubleshooting sequence
When an always-on Android VPN stops working, separate the layers:
- Confirm that mobile data or Wi-Fi works with lockdown temporarily disabled.
- Check the active SIM, signal, roaming, and APN.
- Reconnect the VPN using automatic protocol and a nearby server.
- Verify that the app is still selected as always on.
- Review battery restrictions and background data.
- Disable conflicting Private DNS or network-filter apps for one test.
- Test another network to distinguish carrier blocking from provider failure.
- Collect minimal diagnostics and contact support.
Restore lockdown after testing. Record the cause and fix for future travel.
Android’s system controls can create a strong mobile privacy baseline, especially when paired with a transparent provider and secure carrier account. The goal is not to keep an icon lit; it is to ensure that the protected route survives the network changes your phone experiences every day.
