Android VPN from scratch: install the client, import a subscription, and verify the connection

The first Android VPN setup rarely fails at the moment you tap Connect. It fails at the four things that come before it: which client to install, how to import the subscription link, how to grant the system VPN permission, and whether battery saver will freeze the app in the background. This Android VPN install guide follows the real order of operations, gives you a checkpoint at every step, and ends with how to confirm that your exit IP and DNS really resolve through the international route.

Clients named here are described by type only and are not tied to a specific version; the number and regions of the nodes in your subscription are whatever your account actually shows.

Pick a client first: protocol support decides which routes you can use

A subscription link is just a block of encoded node information; what turns it into a system-wide proxy is the client. Most Android clients ship with their own core, so they work right after install with no extra runtime. The differences come down to two things: which protocols are supported, and how granular the routing rules can get.

The table above lists common pairings, not fixed answers. Client updates change which protocols are supported, so check the protocol dropdown for the one your subscription uses before importing — far less hassle than guessing later why nothing connects.

How the protocols actually differ

• Shadowsocks: light handshake, low overhead, enough for everyday browsing and video, and the fewest settings to get wrong.
• VMess: an older generation that is sensitive to clock skew between client and server, so a device whose time is off will fail authentication.
• VLESS: a leaner successor to VMess with no encryption of its own — security comes from the TLS or Reality layer around it.
• Trojan: disguises traffic as ordinary HTTPS, usually on port 443, so it moves more comfortably through networks that only allow 443.
• Hysteria2 and TUIC: both run over QUIC and use UDP, recovering faster on weak or lossy links, but they are more sensitive to networks that throttle UDP.

Understanding protocols helps you read the symptoms. If the connection drops every so often and reconnecting fixes it, packet loss on the UDP path is the likely cause, and Hysteria2 or TUIC routes usually hold up better than TCP-based ones on weak networks. If pages are merely slow to open and video buffers for a long time, the problem is more likely routing rules or DNS, and switching protocols will not help. Traffic between client and server is protected by the protocol's own encryption layer, and all routes here use military-grade encryption.

Step 1: install the client and check where it came from

Where the installer comes from matters more than the version number. Once VPN permission is granted, the client can take over all traffic on the device, so spend the extra two minutes confirming the source instead of rushing an installer of unknown origin.

1. Get the installer from the client project's official release page, or install the same app from Google Play.
2. During install, Android warns about apps from unknown sources — grant it to that one source only, and revoke it as soon as the install finishes.
3. Open the client and, before connecting, confirm the version info and that the protocol list includes the protocol your subscription uses.
4. Allow the network permission when the system asks; the VPN prompt does not appear yet — that comes in the next step.

Step 2: import the subscription link

A subscription link is an account credential, not an ordinary URL. It carries node addresses and authentication details, and anyone who gets it can burn through your traffic, so do not paste it into group chats or relay it through public clipboard tools.

1. Copy the subscription link from the dashboard, from the very start to the very end. These links are long, and a truncated tail is the most common cause of a failed update.
2. Open the client, find the Subscriptions, Groups or Profiles entry, and create a new group. Name it by region or purpose so you can tell them apart later.
3. Paste the link into the address field, save, then tap Update subscription. Some clients can import straight from the clipboard or a QR code — it is the same string either way.
4. When the update finishes, the node list fills with routes; the entries and regions are whatever the subscription contains. If nothing appears, the subscription was not fetched — go back a step and check.

Subscription contents change as routes are adjusted, and the node list will not refresh itself. When a route stops connecting, update the subscription manually once before blaming the node — it saves a lot of pointless reinstalling.

Step 3: grant VPN permission and connect

Android manages VPN permission at the system level. The client takes over the device's IP-layer traffic through VpnService, so the user has to approve it manually and no app can switch it on silently. Declining this step throws no error — it just looks like tapping Connect does nothing.

1. Select a route in the node list and tap Connect.
2. The system shows a Connection request dialog with the VPN icon and the client name. Tick Always allow, then confirm.
3. A key or VPN badge appears in the status bar, which means the tunnel is up.
4. Go back to the client's home screen and watch the upload and download counters. If the numbers do not move, traffic is not actually going through the proxy.

To review or revoke the permission later, open Settings → Network & internet → VPN, find this profile and delete it. Using the same account on several devices at once is fine — plans here do not limit the number of devices, you just repeat the steps above on each one.

Step 4: battery whitelist and keeping the app alive

Android's battery saver freezes background processes once the screen goes off, and the VPN tunnel dies with them. The symptom is unmistakable: everything works right after connecting, then you lock the phone for ten minutes, unlock it, and every app spins.

1. Settings → Apps → find the client → Battery → choose Unrestricted, or simply turn off battery optimization for it.
2. Chinese OEM builds (MIUI / HyperOS, ColorOS, OriginOS, HarmonyOS and similar) also need Autostart and Background activity permissions enabled separately.
3. Lock the client in the recent apps list so a one-tap clean-up does not sweep it away.
4. If you need it up for long stretches, turn on the system's Always-on VPN and point it at this client; the system will try to reconnect after a drop.

Step 5: verify connectivity

A successful connection does not mean the configuration is right. The tunnel can be up while traffic still skips the proxy because of routing rules, DNS settings or IPv6 preference. Verify at least four things: exit IP, DNS resolution path, whether routing behaves as intended, and whether it recovers after a drop.

• ✅ An international site loads completely, with images and scripts that do not time out.
• ✅ The exit region shown by an IP lookup site matches the region of the route you selected.
• ✅ The DNS lookup shows a resolver on the node side, not your local ISP's address.
• ✅ With routing rules on, domestic sites still open directly while international sites go through the proxy.
• ❌ The exit IP is still your local address: the tunnel is not carrying traffic — go back to step 3 and check the permission.
• ❌ DNS lookups show your local ISP's address: that is a DNS leak — switch DNS to remote resolution or the client's built-in DNS.

How DNS leaks happen

The proxy takes over TCP and UDP traffic, but DNS queries travel a different path. When the client hands domain resolution to the system and the system passes it to your local ISP, resolution happens outside the proxy — that is a DNS leak. It will not cut you off immediately, but it undermines the fact that you are on an international route.

There are two fixes: set the client's DNS to remote resolution so domains resolve on the node side, or use the client's built-in DNS and routing rule sets. Run the DNS lookup again afterwards; if your local ISP's address still shows up, the setting did not take effect.

When IPv6 makes some apps skip the proxy

If the node only offers an IPv4 exit while the device has IPv6 enabled, some apps prefer a direct IPv6 connection, which looks as if the app is skipping the proxy on its own. Turn off IPv6 outbound in the client, or disable IPv6 in the system's APN settings, then restart the client once.

Common trouble spots at a glance

The table below covers the five symptoms that come up most during a first setup; matching symptom to cause is faster than reinstalling everything one by one.

If it still will not connect after that, note the client version, the protocol you selected and the exact error text, then read the notes on routing and DNS in the Help Center — far more effective than reinstalling the client over and over.

Matching routes to your plan

Once the subscription is pulled, the node list usually mixes dedicated, relayed and direct routes, and clients label them. The difference is not how fast they are but how the path is built.

• Dedicated (IEPL): runs over carrier-grade point-to-point links with little jitter at peak hours, which suits long sessions such as video calls and remote desktop.
• Relayed: enters through a relay node before heading out, so the path is a little longer in exchange for steadier connectivity.
• Direct: connects straight to the exit, so latency depends on physical distance — good for speed-sensitive use where stability matters less.

110+ countries and 150+ routes — more regions does not mean every route is fast, and picking by purpose beats picking by region. Long-lived sessions such as meetings and AI tools belong on dedicated routes; for plain browsing and video, direct or relayed is plenty. The full list is on the route list, filterable by region and type.

Traffic resets monthly on the day you activated, and mid-cycle upgrades are prorated against the remaining days. Monthly plans come in three tiers: ¥9.9 for 60GB, ¥18 for 250GB and ¥28 for 500GB. If you use less, traffic packs of ¥158/300GB, ¥358/1000GB and ¥658/3000GB are good until used up and never expire, so nothing is zeroed at the end of the month. Payment accepts Alipay, WeChat and USDT; no email address is needed to register — a username and password are enough, and once you order on the plans page you can start the configuration walkthrough.