How to Enable Always-On VPN on Android and Block Connection Leaks

To enable Always‑On VPN on Android, open Settings → Network & internet → VPN, tap the settings icon beside your VPN, and turn on Always‑on VPN. Then enable Block connections without VPN if you want Android to stop internet traffic whenever the tunnel is unavailable. Menu names vary slightly on Samsung and other phones, but the two controls serve the same purpose.

Always‑On VPN reconnects the VPN automatically. “Block connections without VPN”—also called VPN lockdown—adds the important leak-prevention layer. Without lockdown, your phone may briefly use the normal Wi‑Fi or mobile connection while the VPN reconnects.

Always‑On VPN vs. a VPN kill switch

The terms are often used interchangeably, but Android separates them:

• Always‑On VPN: tells Android to start and maintain the selected VPN connection automatically, including after a restart.
• Block connections without VPN: prevents apps from reaching the internet outside that VPN tunnel.
• In-app kill switch: a similar feature controlled by the VPN provider’s app. Its behavior can vary by provider and protocol.

Android’s system-level blocking option is the strongest choice when you do not want traffic to fall back to the open internet. Google’s Android Enterprise documentation explains that, in lockdown mode, traffic cannot leak to the open internet when the VPN service disconnects.

Before you turn it on

You need a VPN app or a manually configured VPN profile that works correctly on your phone. Connect it normally first and confirm that websites load. If the account has expired, the server is unavailable, or the app requires you to accept a new prompt, enabling lockdown can leave the phone with no internet connection.

Also update Android and the VPN app. Install VPN software only from the provider’s official listing in Google Play, and confirm the developer name. A fake security app can create more risk than it removes—especially if you reached it through a message or QR code. Use our guide to check whether a QR code is safe before scanning if that is how you received the download link.

How to enable Always‑On VPN on stock Android and Pixel

1. Connect to your VPN once through its app and approve Android’s VPN connection request.
2. Open Settings.
3. Tap Network & internet.
4. Tap VPN. If you cannot find it, search Settings for “VPN.”
5. Tap the gear or settings icon beside the VPN you want to use.
6. Turn on Always‑on VPN.
7. Turn on Block connections without VPN for leak protection.
8. Return to the VPN app and confirm that it reconnects.

These steps follow Google’s current Android VPN instructions. Google notes that some app-managed VPN profiles may not expose the Always‑On option in this menu. In that case, look for “auto-connect,” “always on,” or “kill switch” inside the provider’s app and check its documentation.

How to enable it on a Samsung Galaxy phone

On recent Samsung phones, the route is usually:

1. Open Settings.
2. Tap Connections.
3. Choose More connection settings.
4. Tap VPN.
5. Tap the settings icon beside the VPN profile.
6. Enable Always‑on VPN.
7. Enable Block connections without VPN, if shown.

Samsung may change the wording or location between One UI versions. Searching Settings for “VPN” is more reliable than following an old screenshot. If the VPN is controlled entirely by its app, open the app’s connection or security settings instead.

How to confirm the VPN reconnects automatically

Do not assume the feature works just because the toggle is enabled. Test it:

1. Connect the VPN and note the VPN key or shield indicator in Android’s status area.
2. Switch from Wi‑Fi to mobile data. The VPN should reconnect without requiring you to tap Connect.
3. Turn Airplane mode on for ten seconds, then turn it off. Confirm the VPN returns.
4. Restart the phone and unlock it. Allow a short time for Android and the VPN service to start.
5. Open a reputable IP-check page before and after connecting. The public IP should change to the VPN server’s address.

A changed IP is evidence that browser traffic is using the tunnel, but it is not a complete security audit. A VPN can still have DNS, IPv6, split-tunneling, or app-exclusion behavior that differs by provider.

How to test “Block connections without VPN”

With the VPN connected and the blocking option enabled, disconnect the VPN from inside its app. Android should prevent ordinary internet access rather than silently returning to your direct connection. A browser page should fail to load until the VPN reconnects.

Run this test at home, not while you urgently need navigation, a boarding pass, banking access, or work authentication. Know how to return to the system VPN page and disable the block if the VPN app fails.

Why your internet may stop working after enabling lockdown

The VPN needs you to sign in again

An expired session, subscription problem, password change, or new terms screen can prevent automatic connection. Temporarily disable Block connections without VPN, open the official VPN app, complete the required step, reconnect, and then restore the block.

The Wi‑Fi network uses a captive portal

Hotels, airports, cafés, and malls often require you to accept terms or enter a room number before internet access begins. Lockdown may prevent the sign-in page from loading because the network is not yet fully online.

Disconnect from that Wi‑Fi and verify its exact name with staff first. If you trust the network, briefly pause lockdown, complete the portal in the browser, reconnect the VPN, and re-enable blocking. Our separate checklist explains how to tell whether public Wi‑Fi is safe before connecting.

Android is restricting the VPN app in the background

Battery optimization or background-data restrictions may delay reconnection on some phones. Open Settings → Apps → your VPN app → Battery and allow background operation if the provider recommends it. Also confirm that Data Saver is not blocking the app.

Do not disable battery controls for every app. Adjust only the trusted VPN app. If background restrictions are affecting other software, see our guide to managing Android background apps without sacrificing battery life.

The selected server or protocol is unavailable

Open the VPN app and try a nearby server. If the provider offers multiple protocols, switch only to one it officially supports—for example, WireGuard, IKEv2, or OpenVPN—then test again. Avoid random configuration files from forums or file-sharing sites.

Private DNS conflicts with the VPN

Android’s Private DNS setting and a VPN’s own DNS protection can occasionally conflict. Google recommends keeping Private DNS enabled under normal circumstances, but a provider may require a specific configuration. Follow the provider’s official support instructions rather than entering an unknown DNS hostname.

What if the Always‑On option is missing or greyed out?

Common reasons include:

• the VPN app does not declare support for Android’s always-on mode;
• the app manages auto-connect and kill-switch behavior internally;
• a work profile or device administrator controls the VPN;
• another VPN, firewall, ad blocker, or local filtering app already occupies Android’s single VPN slot;
• the selected profile type does not support the system option on that phone.

Android allows only one active VPN service per user or work profile at a time. Apps that block ads or create a local firewall may technically use the VPN interface even when they are not remote VPN services. Disable the competing service, then return to Settings → VPN.

On a managed work phone, do not remove or replace the organization’s VPN. Contact the administrator; the device policy may intentionally lock the controls.

Should you enable it all the time?

Always‑On VPN with lockdown is useful when:

• you frequently move between home, cellular, hotel, airport, and café networks;
• your employer requires traffic to pass through a corporate VPN;
• you want the phone to fail closed instead of using an unprotected connection;
• you might forget to reconnect the VPN after restarting the phone.

It may be inconvenient when a VPN blocks local printers, casting devices, smart-home controllers, banking apps, or captive portals. Look for a trusted-LAN or local-network option in the VPN app, but understand that allowing local traffic creates an intentional exception to full tunneling.

Split tunneling is another exception: selected apps bypass the VPN or only selected apps use it. This can solve compatibility problems, but excluded traffic is not protected by the VPN. Review the exclusion list after app updates.

Does Always‑On VPN protect hotspot devices?

Do not assume that laptops or tablets connected to your phone’s hotspot inherit the phone’s VPN tunnel. Tethered traffic behavior depends on Android, the phone maker, and the VPN app. Test the public IP separately on each connected device, or run a VPN directly on that device.

What a VPN does—and does not—protect

A VPN encrypts traffic between your device and the VPN server and replaces your visible public IP for destinations reached through the tunnel. It can reduce exposure to an untrusted local network, but it does not make every website safe.

A VPN does not:

• prevent you from entering a password on a phishing page;
• remove malware already installed on the phone;
• stop websites from identifying you after you sign in;
• guarantee anonymity from the VPN provider;
• protect apps deliberately excluded through split tunneling;
• replace Android security updates, strong passwords, passkeys, or multi-factor authentication.

Choose a provider you trust, because the VPN becomes an important network intermediary. Prefer clear ownership, understandable privacy terms, modern protocols, independent security audits, and a sustainable business model over vague “free unlimited VPN” claims.

How to turn off Always‑On VPN safely

1. Open Settings → Network & internet → VPN.
2. Tap the settings icon beside the active profile.
3. Turn off Block connections without VPN first.
4. Turn off Always‑on VPN.
5. Disconnect or remove the profile only if you no longer need it.

If you uninstall a VPN while lockdown is still active and lose internet access, return to the VPN settings, select the old profile if it remains, and disable both controls. Restart the phone afterward if the network does not recover.

Bottom line

For the strongest built-in leak protection on Android, enable both Always‑On VPN and Block connections without VPN. Always‑On handles reconnection; the blocking option stops traffic from escaping outside the tunnel. Test the setup across Wi‑Fi, mobile data, Airplane mode, and a phone restart before relying on it while traveling or working.

Android’s developer guidance describes Always‑On VPN as a framework that keeps a trusted connection running, while VPN lockdown prevents traffic from leaking to the open internet when the service disconnects. That combination—not the VPN app’s “connected” screen alone—is what provides fail-closed behavior.