Android VPN settings · checked 2026-11-03
Android Always-on VPN: what the settings do
Understand Android Always-on VPN and Block connections without VPN, when apps may lose connectivity, and how to check current settings.
What does Always-on VPN do on Android?
Android can start a configured VPN service when the device boots and keep it running. The VPN app still needs to establish and maintain its connection to its server. Available controls depend on the device, Android version, VPN app, and management profile.
What does Block connections without VPN do?
On supported Android configurations, this setting blocks network traffic that does not use the VPN. Android warns that apps outside configured allow or deny lists can lose network access. Some apps may also need to bypass a VPN for their intended function, so check the app and device documentation before enabling restrictions.
How do I find these settings?
Open Settings, search for VPN, then open the settings for the VPN profile. Android Help documents Network & internet > VPN as a route on supported devices. Menu labels and availability vary; some app-based VPN setups do not expose the system Always-on option.
Does the VPN key icon prove that lockdown is working?
No. Android Developers describes the key icon as an indicator that a VPN connection is active. It does not show whether Block connections without VPN is enabled, which apps are excluded, or whether every app uses the tunnel. Reopen the VPN profile settings and check both system switches and the VPN app's own connection status.
Why is Always-on or Block connections without VPN missing or unavailable?
Android Help notes that some VPNs set up through an app do not expose the system Always-on option. Check the VPN app's Android support instructions, search Settings for VPN, and check whether a work profile or device administrator manages the setting. Samsung documents a separate Knox VPN framework for managed configurations; menu names and behavior can differ by device, software version, and management setup. Ask the administrator before changing a managed device.
Does enabling this prove that no traffic can escape?
No setting or browser check here proves that every device, app, or network configuration behaves as intended. Review per-app routing and exceptions, keep the VPN app and operating system updated, and consult the VPN provider's instructions. For a low-risk check, compare the public IP while connected and disconnected using a separate test service; do not treat that browser observation as a complete audit.
What if my internet stops working?
A blocked connection can be expected when the VPN is unavailable and non-VPN traffic is blocked. Check the VPN connection, allowed or excluded apps, and any work-profile or administrator policy. Android's documented settings differ by version and device; contact the device administrator for managed devices.
What should I check if Always-on is enabled but the VPN seems disconnected?
Search Settings for VPN, reopen the selected profile, and compare the Always-on and Block connections without VPN switches with the VPN app's status or persistent notification. Android Help says a failed Always-on connection can leave a notification until reconnection. If the device is offline while lockdown is enabled, first check whether the VPN can reconnect and whether a configured app exception explains the behavior. Use the VPN disconnect and Wi-Fi troubleshooting guides for the next reversible checks; do not treat the key icon alone as proof of per-app coverage.
Sources
- Android Help: Connect to a VPN on Android and manage Always-on VPN (accessed 2026-11-03)
- Android Developers: VPN and blocked connections (accessed 2026-11-03)
- Android Enterprise Help: Always-on VPN, per-app VPN, and blocking non-VPN connections (accessed 2026-11-03)
- Samsung Knox: Android AlwaysOn and Knox KeepOn VPN framework differences (accessed 2026-11-03)