Always-on VPN on Android: what it does and how to turn it on

Always-on VPN is an Android system setting that tells the phone to start a chosen VPN app at boot and to bring the tunnel back whenever it drops, without you opening the app. It lives in the system VPN settings, behind the gear icon next to the app's name, and it comes with a second toggle, Block connections without VPN, that stops every app reaching the internet unless the tunnel is up. Together they are the difference between a VPN you remember to turn on and one that is simply always there.

What always-on actually changes

Without it, a VPN is an ordinary app. You tap connect, the tunnel comes up, and it stays up until you disconnect, the phone restarts, or Android decides the app has been in the background long enough and stops it. Nothing brings it back on its own.

With always-on set, Android takes over the starting. When the phone boots and you unlock it, the system starts the VPN app's service without any tap from you. If the tunnel goes down, whether the app crashed, the network changed, or the battery optimiser killed it, Android restarts it. The app's own auto-connect settings become a backup rather than the main mechanism.

That is why it is the fix for two complaints that look unrelated: a VPN that keeps disconnecting, and a VPN that is off after every restart.

How to turn it on

1. Open Settings > Network & internet > VPN. On Samsung phones it is Settings > Connections > More connection settings > VPN, and on Xiaomi phones Settings > Connection & sharing > VPN. Manufacturers move this around, so searching Settings for "VPN" works on any of them.
2. You will see each installed VPN app listed. Tap the gear icon next to the one you want.
3. Turn on Always-on VPN.
4. Decide about Block connections without VPN. Leave it off for now if you are unsure; the section below explains what it does.

Android will connect the VPN as soon as always-on is turned on, if it is not already connected. From then on the app appears in the list with "Always-on" under its name.

Only one app can hold the setting. If a different VPN app is already always-on, Android turns it off for that app when you turn it on for this one.

The block toggle

Block connections without VPN is what most people mean by a kill switch. While it is on and the VPN is down, no app can send or receive anything: not the browser, not messaging, not background sync. The only traffic Android allows is the VPN app's own, so it can connect.

The block applies in every gap: before the VPN has connected after boot, while it is reconnecting after a network change, and if the app has been stopped. That is exactly what you want if the point of the VPN is that the local network never sees your traffic. It is more than you want if the point is convenience on the train. Block connections without VPN goes through the trade-offs in detail, and why the OS should own the kill switch explains why an app cannot do this job itself.

Where it gets in your way

Two situations catch people out.

New Wi-Fi networks with a sign-in page. Hotel and café Wi-Fi often requires you to accept terms in a browser before you have internet access. With the block on, the browser cannot reach the sign-in page because the VPN is not up, and the VPN cannot come up because you have not signed in. The way out is to turn the block off for a minute, sign in, then turn it back on. The captive portal post covers this in full.

Apps that must not go through a VPN. Always-on carries every app on the phone, and the block stops them cold when the tunnel is down. If a banking app or a local-network app needs to stay outside, use the VPN app's split tunnelling to exclude it. Excluded apps are unaffected by both toggles.

Always-on versus the app's own auto-connect

Many VPN apps offer "connect on start" or "reconnect automatically" settings. These run inside the app and work only while the app is alive. They cannot start the app after a reboot, and they cannot survive the app being killed. Always-on is the system doing the same job from outside the app, which is why it is more reliable and why it is the setting to reach for first. Use the app's options as well if you like; they do not conflict.

How to tell it is on

Look at the VPN list in Settings: the app shows "Always-on" beneath its name. On the phone itself, the status bar key icon should be present from shortly after unlock. A VPN app can also read the state and show it, which is more useful than a toggle inside the app that only claims to do the same thing.

Culvert VPN has no in-app always-on switch by design; its Settings screen reads Android's real always-on and block state each time it opens and links straight to the system setting, and it is on Google Play.