How to Set Up a VPN on Android: The Complete 2026 Guide

Last updated: November 7, 2026 · 18 min read

To set up a VPN on Android, install your VPN provider’s app from Google Play, sign in, tap Connect and accept the VPN permission request that Android shows. A key icon in the status bar confirms that the tunnel is up. Then set the app’s battery use to Unrestricted, and turn on Always-on VPN and Block connections without VPN in Android’s VPN settings.

If your provider gives you a WireGuard .conf file or QR code, or an OpenVPN .ovpn file, you can import it into the WireGuard app or OpenVPN for Android instead. Android’s built-in IKEv2/IPsec client is the fourth method, for corporate or self-hosted IKEv2 servers. If you are new to VPNs and want to understand how they work before setting one up, start with our guide to how VPNs work, then return here.

Scope: All steps in this guide apply to Android 10 and above, which covers more than 90% of active Android devices as of 2026. From Android 12, Android’s built-in VPN client, in Android’s own Settings app, offers only IKEv2/IPsec types for new profiles, so PPTP and L2TP/IPsec stay only on profiles that existed before the change. This guide does not cover PPTP or L2TP/IPsec.

Choose Your Setup Method

Before the steps, use this table to find the right method for your situation.

Not sure which protocol to choose? WireGuard is the right default for most users in 2026, because it delivers significantly higher throughput than OpenVPN, substantially lower battery consumption, and near-instant reconnection times. For a full technical comparison, see our WireGuard vs OpenVPN guide. If your app also offers IKEv2, our WireGuard vs IKEv2 comparison explains when to choose each protocol.

Method 1: Official Provider App (Recommended for Most Users)

If you use a commercial VPN provider such as ProtonVPN, Mullvad, IVPN or NordVPN, the provider’s official app is the fastest and most reliable path to a working connection. The app needs no config files, no key generation and no manual field entry.

Step-by-Step Installation

1. Open the Google Play Store (or F-Droid if you prefer open-source app distribution) and search for your provider by name.
2. Tap Install and open the app once it completes.
3. Create an account or log in with your existing credentials.
4. Tap Connect to use the app’s recommended server, or select a specific country or city first.
5. On your first connection, Android shows a VPN permission dialog, which is expected. Tap OK to allow the app to manage your VPN connection.
6. Confirm that the connection is active: a key icon appears in your status bar.

Provider Notes

• ProtonVPN offers a free tier with no data cap and no speed limit. WireGuard and Stealth are available on all plans including free (free servers may be more congested due to fewer locations). The app includes an always-on VPN shortcut in its settings.
• Mullvad requires no email address, and login uses an account number only. WireGuard is the default protocol. Mullvad has one of the strongest no-log track records in the industry.
• IVPN uses an account ID for login and requires no email address. WireGuard is the default protocol, and paid plans offer multi-hop routing.
• NordVPN has used NordLynx, which adds a double NAT layer to WireGuard for privacy, as its default since 2020.

Protocol Selection

Most provider apps default to WireGuard or a WireGuard-based protocol and select it automatically. If your app has a protocol toggle in its settings, keep WireGuard selected unless you have a specific reason to change it. On a network that blocks WireGuard’s UDP traffic, for example, OpenVPN over TCP is a reliable fallback.

One Required Step: Exempt the App From Battery Optimization

Android’s battery management aggressively kills background apps, including your VPN app, and causes silent disconnections with no warning. This is the most common reason VPNs appear to stop working on Android. Fix it once during setup:

Settings → Apps → [your VPN app] → Battery → Unrestricted

Setting this to Unrestricted tells Android not to kill the app in the background. This setting is a one-time step, not a troubleshooting measure, so change it immediately after your first successful connection.

Method 2: WireGuard App Manual Configuration

Use this method if you are connecting to a self-hosted WireGuard server, or if your provider supplies a .conf file or QR code for manual configuration. Mullvad and ProtonVPN both offer manual WireGuard config downloads from their web dashboards.

Step-by-Step

1. Install the WireGuard app from Google Play. The WireGuard project, created by Jason Donenfeld, maintains this official open-source app, and the underlying WireGuard protocol has been formally verified through symbolic and computational proofs.
2. Tap the + button and choose your import method:
   • Scan from QR code is the fastest option. Log in to your provider’s web dashboard, navigate to manual WireGuard config, generate a configuration, and display the QR code. Scan it with the app. The tunnel is configured instantly with no manual typing.
   • Create from file or archive imports a .conf file that you download from your provider.
   • Create from scratch means entering every field by hand. Use this option for self-hosted servers where you control the key pairs.
3. Toggle the tunnel name to connect.
4. Confirm the key icon appears in the status bar.

Config file naming: Before importing a .conf file, rename it to remove any spaces or special characters. The WireGuard Android app uses the filename (minus the .conf extension) as the tunnel name, and tunnel names only accept alphanumeric characters, dashes, and underscores. A filename with spaces will produce an “Invalid name” error on import. Example: rename my vpn config.conf to myvpnconfig.conf before importing.

Key Fields for Manual Entry

If you are configuring a self-hosted server from scratch, here are the fields and what they expect:

[Interface]

• Private Key: generate it with wg genkey on your server, or tap Generate in the app.
• Address is your assigned IP address within the VPN subnet, such as 10.0.0.2/32.
• DNS is your VPN provider’s DNS server address.
• MTU: leave it blank for the automatic value of 1420, or set it manually if you encounter connection issues, as the Troubleshooting section explains.

[Peer]

• Public Key is your server’s public key.
• Allowed IPs: enter 0.0.0.0/0, ::/0 for a full tunnel that routes all traffic through the VPN.
• Endpoint is your server’s IP address and port, such as 203.0.113.1:51820.

Method 3: OpenVPN for Android Manual Configuration

Use this method if your provider supplies .ovpn configuration files. If your provider offers WireGuard and OpenVPN configs, the WireGuard path in Method 2 suits most users better.

1. Install OpenVPN for Android from Google Play. This is the open-source client by Arne Schwabe, preferred in the privacy community over the commercial OpenVPN Connect app.
2. Download the .ovpn configuration file from your provider’s website. Most providers have a dedicated “manual configuration” or “config files” section in their dashboard.
3. Open OpenVPN for Android, tap the folder icon in the top right, and select your downloaded .ovpn file.
4. If your provider requires separate credentials (username and password separate from the config file), enter them when prompted.
5. Tap your profile name to connect and accept the VPN permission dialog.
6. Confirm the key icon in the status bar.

OpenVPN Connect vs OpenVPN for Android: Both apps accept the same .ovpn files and are functionally equivalent for most users. OpenVPN for Android (Arne Schwabe) is open-source and auditable. OpenVPN Connect is the official commercial client from OpenVPN Inc. Either app works, and the difference between them is transparency, not performance.

Method 4: Android’s Built-in IKEv2/IPsec Client

Important: This method is for connections to a corporate or self-hosted IKEv2 server, which you set up by hand or receive from an IT department. Consumer VPN providers, including ProtonVPN, Mullvad, NordVPN and IVPN, do not support this method in 2026. If you are setting up a commercial VPN service, use Method 1 or Method 2 instead. The built-in IKEv2 types are available from Android 11, on phones whose maker enables IPsec tunnel support.

Path: Settings → Network & Internet → VPN → tap + (Add VPN)

Configuration Fields

• Name is a label for the connection, such as “Work VPN”.
• Type: select your authentication method, which is IKEv2/IPsec MSCHAPv2 for a username and password, IKEv2/IPsec PSK for a pre-shared key or IKEv2/IPsec RSA for a certificate.
• Server address is your VPN server’s hostname or IP address.
• IPsec identifier: the identity your phone sends to the server, such as an email address, a domain name or an IP address. Enter what your administrator or provider gives you; some phones let you leave it empty.
• Remote ID (on some phones, such as Samsung models, “IPSec remote identifier”): the identity your phone expects from the server, usually the server address. See the note below if you encounter handshake failures.
• Credentials are the username and password, pre-shared key or certificate that your authentication type needs.

Installing Digital Certificates (RSA Authentication)

If your configuration uses certificate-based authentication, install the certificate before you create the VPN profile, not after. Android’s credential store requires the certificate to exist before it can be referenced during profile setup.

Path: Settings → Security → Credential Storage → Install a Certificate → VPN & app user certificate

Supported formats are .p12 (PKCS#12, contains both certificate and private key) and .crt (certificate only). Your IT department or server administrator will supply the correct file.

IKEv2 Handshake Failures and the Remote ID

If the connection fails immediately after attempting to connect, the Remote ID field is a common culprit. IKEv2 is strict about identities: the server must accept the identity your phone sends, and the identity the server presents must match your phone’s Remote ID setting. A mismatch causes an authentication failure with minimal diagnostic information. If you are seeing immediate connection failures, try setting the Remote ID to the server’s IP address rather than its DNS hostname. This resolves the most common class of IKEv2 handshake mismatches across Android devices.

Security Hardening

Getting a VPN connected is step one. These four settings determine whether it actually protects you consistently.

Always-on VPN

Path: Settings → Network & Internet → VPN → tap the gear icon next to your VPN profile → enable Always-on VPN

With this toggle on, Android starts the VPN app when the phone starts up and keeps it running, but keeping the tunnel connected is the VPN app’s job. Always-on VPN on its own does not block traffic while the VPN is down; Block connections without VPN does that. The always-on VPN guide explains how Android’s setting compares with the Windows and iPhone versions. Enable this for every VPN profile you use regularly.

Block Connections Without VPN

In the same gear icon menu, enable Block connections without VPN. This is Android’s system-level kill switch: with it on, Android blocks network traffic that does not go through the VPN, and apps have no internet connection until the VPN connects. It does not block everything, though: Android’s developer documentation says system apps can always bypass the VPN.

For a full explanation of how VPN kill switches work, how to test yours, and when to use them, see our VPN kill switch guide.

What Block connections without VPN breaks, and how to handle it:

Local network devices: Printers, NAS drives, smart TVs, and Chromecast become unreachable because all traffic must route through the VPN tunnel. Check your VPN app’s settings for a “LAN access” or “exclude private IPs” option, because some apps can route local network traffic correctly even with Block connections without VPN on.

Captive portals: If a hotel or airport Wi-Fi sign-in page does not load, switch off Block connections without VPN, sign in to the Wi-Fi network, and switch it back on straight away.

Note: Always-on VPN and Block connections without VPN are set per VPN profile in Android Settings, not inside the provider app. Some apps surface their own kill switch toggle in their settings, but the system-level control in Settings is the authoritative one. Enable both.

Per-App VPN (Split Tunneling)

Most major VPN apps include a split tunneling feature in their settings, typically labelled “split tunneling,” “per-app VPN” or “app exclusions.” This feature lets you route specific apps outside the VPN tunnel. A practical example: route your banking app directly using your real IP address to avoid fraud flags from VPN exit nodes, while every other app on your device stays inside the tunnel. Look for this option inside your VPN app’s settings, not in Android’s system VPN menu. For a full explanation of how split tunneling works, its risks, and when to use it, see our split tunneling guide.

Private DNS: Fix the Potential Leak

Android 9 and above includes a Private DNS setting (DNS-over-TLS). When Private DNS is set to a specific provider hostname, sometimes called “strict mode,” it can override your VPN app’s configured DNS server. Your DNS queries then go to the DoT provider instead of your VPN’s resolver, so that provider can see the domains you visit even while the VPN is active.

The default “Automatic” mode is less likely to cause this conflict and is usually safe to leave in place. If a DNS leak test confirms a leak while a VPN is active, check this setting first:

Settings → Network & Internet → Private DNS

Set it to Off or Automatic. If it is set to a specific hostname (strict mode), that is the likely source of the leak. For the full DNS leak test methodology and fixes, see our DNS leak guide.

Version-Specific Issues in Android 15 and 16

Android 15: Private Space Does Not Inherit Your VPN

Android 15 introduced Private Space, a sandboxed profile that isolates sensitive apps, such as a secondary account, banking apps or anything else you want separated from your main profile. Private Space behaves as an independent Android profile with its own network routing. A VPN configured and connected on your main profile does not extend into Private Space.

In practice: if you are running apps inside Private Space while your main-profile VPN is connected, those apps are connecting through your bare ISP connection with no VPN protection. The UI gives no indication of this, because the key icon in your status bar shows your main profile’s VPN status only.

Fix: Open Private Space → install your VPN app inside the Private Space sandbox → connect to the VPN independently from within Private Space. The VPN connections on each profile operate separately and must both be active for full coverage.

Android 16: Network Stack Corruption Bug

A documented bug in Android 16 causes VPN connections to fail silently after a VPN app is updated via Google Play while the tunnel is active. The update process corrupts Android’s network stack at the system level. The VPN appears connected, and the key icon remains in the status bar, but traffic stops flowing through the tunnel.

This bug has been reported and confirmed by Proton VPN, Mullvad, TunnelBear, and WireGuard developers, and is tracked on Google’s Issue Tracker. It remained unpatched as of April 2026.

Workaround and fix:

• Step 1: Reboot the device. A full device reboot often resolves the network stack corruption and is the simplest first step. Restart your phone, reconnect the VPN, and verify traffic is flowing correctly.
• Step 2: Reinstall the VPN app if a reboot does not resolve the problem. Restarting the VPN app alone does not fix the issue. If a device reboot does not restore normal VPN behaviour, a full reinstall of the VPN app is the reliable fix: uninstall the app, reinstall it from Google Play and reconnect.
• Preventive measure: Disable automatic Play Store updates for your VPN app to prevent the bug from occurring during active sessions. Open Google Play → your VPN app’s page → three-dot menu → Disable auto-updates. Update the app manually when not actively using the VPN tunnel.

Verify Your Connection

Once connected, take two minutes to confirm the VPN is working correctly on both sides.

1. Before connecting: Visit an IP-check site (such as whatismyipaddress.com or ipleak.net) and note your real IP address and location.
2. After connecting: Refresh the page. Your IP address should now show the VPN server’s address and the server’s location, not your real one. If it still shows your real IP, the VPN is not routing traffic correctly.
3. DNS leak check: On the same page (ipleak.net shows both), confirm that all DNS servers listed belong to your VPN provider. If your ISP’s DNS servers appear, you have a DNS leak, so return to the Private DNS section above.

Troubleshooting

Frequently Asked Questions

Does Android have a built-in VPN?

Android includes a built-in VPN client at Settings → Network & Internet → VPN. From Android 11, on phones whose maker enables it, the client supports IKEv2/IPsec connections that you set up by hand or receive from an IT department. Consumer VPN providers such as ProtonVPN, Mullvad and NordVPN do not support this method. For commercial VPN services, use the provider’s app (Method 1) or the WireGuard app (Method 2).

How do I set up a VPN on Android without an app?

Android’s built-in IKEv2/IPsec client (Method 4 above) works without a third-party app, but it needs a server address, authentication credentials and, for certificate-based setups, a digital certificate file from your provider or IT department. Very few consumer VPN providers support this method in 2026. If your provider does not list IKEv2 manual configuration in their documentation, this path will not work with their service.

Why does my VPN keep disconnecting on Android?

The most common cause is Android’s battery optimization: the OS kills the VPN app in the background to save power, which causes silent disconnections with no error message. Fix it by going to Settings → Apps → [your VPN app] → Battery → Unrestricted. After applying this, also turn on Always-on VPN in Settings, so Android starts the VPN app with the phone and keeps it running.

Does a VPN slow down Android?

WireGuard-based connections, which Mullvad, IVPN and NordVPN’s NordLynx use, have minimal overhead on modern Android hardware. For a detailed breakdown of how VPN protocols affect performance and battery life on mobile, see our VPN battery drain guide.

Is the WireGuard app on Android safe?

The WireGuard project, created by Jason Donenfeld, develops the WireGuard Android app as open-source software. The underlying WireGuard protocol has been formally verified through symbolic and computational proofs, which makes it one of the most rigorously analysed VPN protocols available. For a full technical comparison of WireGuard against OpenVPN and other protocols, see our WireGuard vs OpenVPN guide.

Does a VPN protect apps running in Android Private Space?

A VPN connected on your main profile does not extend into Android 15’s Private Space, which operates as an independent Android profile with its own network routing. Apps inside Private Space connect through your bare ISP connection even when your main-profile VPN is active and showing a connected status. To protect Private Space traffic, install your VPN app inside Private Space and connect to it independently. Full details are in the Version-Specific Issues section above.