Why VPN sessions expire and reconnect

A VPN session expires because everything in it is meant to be temporary: the keys that encrypt it, the record on the server that says your device is allowed to connect, and the address the server assigned you inside the tunnel. A hard ceiling, 24 hours in Culvert VPN's case, forces all of those to be replaced on a schedule rather than living for as long as the app happens to stay open. When the ceiling arrives the app reconnects on its own, and the only visible effect is a brief gap.

What a session is

When a VPN app connects, two separate things happen. The app first asks the provider's control service for permission to use a particular server, and receives a session: a short-lived credential, the server's key and address, and an address for the phone inside the tunnel. Only then does it perform the handshake with the server itself, which the handshake post describes.

The session is what ties those two steps together. On the server it is a record saying "this key may connect until this time". On the phone it is what the app presents to get the server to accept its handshake. It is deliberately not tied to your identity: the server holds an opaque id for the session, not an account.

Why sessions have a ceiling

Four reasons, and they compound.

The server should be able to forget you. A server that keeps a session record forever accumulates a history of every device that ever connected. One that expires records after a fixed time holds only what is currently live, so a server examined at any moment reveals a set of opaque ids and nothing older. The post on what a seized server reveals explains why this matters more than any policy statement.

Keys should not live indefinitely. WireGuard rotates its session keys roughly every two minutes on its own, which handles the encryption side. The long-term credential that authorises the connection is a different thing, and the way to keep it short-lived is to expire it and issue a new one.

Servers need to be maintained. A server is upgraded, moved or retired by draining it: refusing new sessions and waiting for existing ones to end. With no ceiling, a single client that stays connected could hold a server open indefinitely. With a 24-hour ceiling, every server is empty within a day of being drained, and users are moved to a healthy one by the ordinary reconnect they would have done anyway.

Shared capacity has to be returned. On a free tier, a session that never ends is a slot that is never freed. A time limit is how a shared pool of servers keeps serving new people, which the free data limits post covers.

What happens at expiry

Apps with open connections through the tunnel see those connections reset and retry, which is the same thing that happens on any brief network change. A download in progress may pause and resume; a video call may drop a moment of audio. If the app is well built, it schedules the reconnect rather than waiting to be cut off, so the gap is as short as a handshake.

Because the new session is chosen fresh, the app may land on a different server in the same city than before. That is intentional. It is how load is spread and how a draining server empties without anyone doing anything.

A session ending is not a disconnect

It is worth telling the two apart, because they feel similar and have different fixes.

A session ending is scheduled, happens roughly once a day at most, and is followed within seconds by a new tunnel on the same network. A disconnect is unscheduled, can happen many times a day, and usually has a cause on the phone or the network: Android putting the app to sleep, a NAT mapping expiring, a network switch the app did not follow, or a battery optimiser killing the process. The post on VPNs that keep disconnecting on Android goes through those in order. If your VPN drops every few minutes, it is not the session ceiling.

The one case where a session ending looks like a disconnect is when the reconnect fails: the network has changed to one that filters the previous transport, or the phone is asleep and the app cannot run. The app should then start its normal connection ladder from the top, exactly as if you had tapped connect.

What the server keeps, and what it does not

Because sessions are the unit the server works in, they are also the unit of what it knows. Culvert VPN's servers see only the opaque session id, never an account, and hold it only while the session is live; the control service does not log the sites you visit, your DNS queries or the contents of your traffic, and keeps the client IP address for up to 30 days for abuse handling, as its privacy policy sets out.

Culvert VPN gives every session a hard 24-hour ceiling, schedules the reconnect before it arrives, and brings the tunnel back up on its own with a fresh session and freshly chosen server; it is on Google Play.