Android 15 and 16: Always-on and Per-app VPN — Step-by-Step Setup Guide for Pixel

Introduction

In this step-by-step guide, you'll set up a stable and secure VPN on Android 15 or 16. You'll enable Always-on, restrict traffic to VPN only (lockdown mode), and configure Per-app rules to route VPN traffic selectively for chosen apps or exclude some entirely. We'll walk you through two trusted Android client options — WireGuard and OpenVPN — plus IKEv2 using the built-in client. You’ll achieve a setup that automatically starts after reboot and blocks any traffic bypassing the VPN. Along the way, you’ll learn to check for DNS and IPv6 leaks and troubleshoot issues if they arise.

Who this guide is for. Beginners seeking clear, ground-up instructions and advanced users will find dedicated sections on MTU optimization, split tunneling, managed profiles, and a brief on VPN API changes in Android 15/16. If you’re configuring VPN on a work phone, see sections about Managed Profiles and Always-on policies via device management. VPN client developers will find practical tips for targeting SDK 35/36.

What you need to know beforehand. Nothing complicated. We explain everything in plain language and don’t skip any obvious steps. If you’ve ever installed an app from Google Play and opened Android settings, you can handle this. We detail exactly where to tap, what to enter, and how to check.

How long it will take. Basic WireGuard setup with Always-on and traffic lockdown takes about 20–30 minutes. Another 20–30 minutes for Per-app rules and tests. Advanced optimizations and corporate scenarios require an additional 15–30 minutes, depending on your needs.

Preparation

Before starting, make sure you have everything needed. This saves time and reduces errors.

Required tools and access

• An Android 15 or 16 smartphone. We’ll demonstrate with a Google Pixel running stock Android. We also provide alternatives for Samsung (One UI) and Xiaomi/POCO/Redmi (HyperOS/MIUI).
• Internet access on your phone (Wi-Fi or mobile data).
• Access to a VPN server and its configurations. You can use existing WireGuard or OpenVPN configs, or IKEv2 parameters.
• Ability to install apps from Google Play (WireGuard, OpenVPN Connect, OpenVPN for Android) if needed.

System requirements

• Android 15 or 16. Most instructions are similar for Android 14, though menu titles may differ slightly.
• At least 30% battery; better to plug in before starting.
• 50–100 MB free space to install clients and store configs.

What to download and install

• WireGuard (official client). Supports .conf and QR import.
• OpenVPN Connect (official) or OpenVPN for Android (offers advanced settings). Suitable for .ovpn files.
• For IKEv2, no extra app needed—you’ll use Android’s built-in settings, but you need server details and certificates.

Backups

You don't need a full system backup. However, keep VPN configurations safe—in password managers or encrypted cloud storage. If importing configs from another device, ensure they don’t end up in unencrypted photo galleries or open folders.

Tip: If this is a work phone, coordinate with IT before enabling Always-on and lockdown modes. Corporate policies might manage these centrally and restrict user access.

Basic Concepts

Key terms made simple

• VPN — a secure tunnel for your internet traffic. It encrypts data and routes it through a server so ISPs and third parties can't see your traffic content or destinations.
• Always-on VPN — a mode where VPN starts automatically after reboot and tries to stay connected at all times.
• VPN lockdown (Block without VPN) — a feature that blocks all internet traffic if the VPN disconnects, preventing accidental leaks.
• Per-app VPN — lets you select specific apps to route through the VPN or exclude certain apps from the tunnel.
• Split tunneling — a technical term for splitting traffic: some goes through the VPN, some goes directly. Per-app is a type of split tunneling.
• Config or profile — the settings file for a VPN client, e.g., .conf for WireGuard, .ovpn for OpenVPN, or parameter sets and certificates for IKEv2.

What’s important before you start

• The VPN client must remain running in memory to keep the connection. Android 15/16 manages background apps carefully; we’ll show you how to guarantee stability.
• Always-on is system-level, but the tunnel is maintained by the app. If the app is force closed or loses network, the tunnel drops but should restart properly when configured right.
• Per-app depends partly on client capabilities. We cover Android’s native method where available, plus settings inside WireGuard/OpenVPN clients.

⚠️ Note: PPTP and L2TP without IPsec are outdated and insecure on modern Android versions. Use WireGuard, OpenVPN, or IKEv2/IPsec for both speed and security.

Step 1: Update Android and Prepare Your Device

Goal

Check your Android version, update your system, and get your phone ready for stable VPN operation.

Step-by-step guide

1. Open Settings on your phone.
2. Scroll down and tap System or About phone depending on your device.
3. Find Android Version and confirm it says 15 or 16.
4. Go back, then go to System → System update. Tap Check for updates. Install all available security patches and wait for completion.
5. Restart your phone after updates if prompted.
6. Open Settings → Apps → Special app access → Unrestricted data access. Find your VPN client app (WireGuard or OpenVPN). If not installed yet, return here after install. Enable Allow unrestricted data access for the VPN app.
7. Go to Settings → Battery → Battery saver. Disable aggressive battery saving modes that affect background activity, or add the VPN app to exceptions. On Pixel: Settings → Apps → All apps → WireGuard → Battery → Unrestricted. Samsung: Settings → Apps → WireGuard → Battery → Allow background activity. Xiaomi: Settings → Battery → App battery saver → WireGuard → No restrictions.
8. If you use a launcher with optimizations, disable task killers for the VPN client.

Tip: Add a VPN client shortcut to your home screen now for quick tunnel restarts with one tap.

Expected result

Your device is updated, VPN client’s background operation is unrestricted, and you’re ready to proceed.

✅ Check: Open Settings → Apps → WireGuard (or your client) → Battery. It should say No restrictions or Unrestricted.

Possible issues and solutions

• Updates unavailable. Cause: vendor hasn’t released patches yet. Solution: check again later and continue setup on current version.
• Battery menu missing. Cause: different UI. Solution: search settings for Battery or Background to find the equivalent option.

Step 2: Install VPN Client and Import Config

Goal

Install your chosen client, import the configuration, and confirm the basic tunnel connects.

WireGuard detailed instructions

1. Open Google Play, search for WireGuard, and install.
2. Launch WireGuard. Tap the plus icon on the main screen.
3. Choose Import from file or archive if you have a .conf file, or Scan from QR code if your provider gives one.
4. Locate the .conf file in your file manager and select it. Grant file access permissions if requested.
5. Name the profile clearly, e.g., WG-Home or WG-Work.
6. Save. A toggle will appear next to the profile. Turn it on. Confirm the VPN connection prompt by tapping OK.

OpenVPN detailed instructions

1. Install OpenVPN Connect or OpenVPN for Android from Google Play.
2. Launch the app and tap Import.
3. Select Import from file and locate your .ovpn file. If certificates or credentials are needed, enter them when prompted and save the profile.
4. Tap Connect. Confirm the VPN connection prompt.

IKEv2 setup (built-in Android client)

1. Go to Settings → Network & internet → VPN.
2. Tap the plus icon or Add VPN.
3. Choose IKEv2/IPSec PSK or IKEv2/IPSec RSA based on your server.
4. Enter Name, Server address, Identity, Pre-shared key (for PSK), select User certificate (for RSA). Save.
5. Tap the profile → Connect. Enter credentials if required.

Tip: Unsure what to choose? Start with WireGuard — it’s easy, battery-efficient, and reliable on Android.

⚠️ Warning: Before importing configs, confirm the source is trustworthy. Never use publicly shared keys or generic credentials — this risks interception and service sanctions.

Expected result

You can manually connect to VPN and see a Connected status. A key icon appears in the status bar.

✅ Check: Open a browser, search "My IP," and verify your external IP matches the VPN server’s address.

Common issues and fixes

• Connection fails. Cause: wrong address or key. Fix: double-check config, verify internet, restart phone.
• OpenVPN asks for credentials you don’t know. Cause: server requires login. Fix: request credentials from your provider or use a cert-based profile.
• WireGuard connects but no traffic. Cause: incorrect AllowedIPs or missing 0.0.0.0/0 route. Fix: adjust config on server or client side.

Practical server choice advice

If you want predictable results without shared IPs or issues from other users on the server, check out vpn.how. It offers personal VPN servers with dedicated IPs supporting WireGuard, OpenVPN, IKEv2, L2TP, SSTP (choose by task and device compatibility) with locations in Moscow, Saint Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, Stavanger. Payments accepted via Russian cards (Tinkoff, Ozon), SBP, USDT/BTC, plans start at ₽490 per day or ₽2490/month with long-term discounts, auto-server startup in 5 minutes post-payment, and no-logs policy. The client dashboard provides ready configs for WireGuard, OpenVPN, and IKEv2—just download and import to your device for a flawless setup that minimizes mistakes.

Step 3: Enable Always-on VPN and Lockdown Mode

Goal

Ensure VPN turns on automatically and blocks any internet traffic if disconnected. This is your key security layer on Android 15/16.

Instructions for Google Pixel (Android 15/16)

1. Go to Settings → Network & internet → VPN.
2. Find your VPN app in the list and tap the gear icon or its name to open profile settings.
3. Enable Always-on VPN toggle.
4. Turn on Block connections without VPN (also called Lockdown or VPN lock). Confirm the warning that internet will be blocked without VPN.
5. Exit settings and reboot your phone to verify the profile activates automatically.

Instructions for Samsung (One UI)

1. Open Settings → Connections → More connection settings → VPN.
2. Tap the gear icon next to your VPN profile.
3. Enable Always-on.
4. Enable Block without VPN if available. Confirm.
5. Restart your device to test auto-start.

Instructions for Xiaomi/POCO/Redmi (HyperOS/MIUI)

1. Open Settings → Connections & sharing → VPN.
2. Tap the profile or settings icon.
3. Turn on Always-on or a similarly named option.
4. Find and enable Block traffic without VPN, if present.
5. Reboot, then check for the key icon after enabling Wi-Fi or mobile data.

Tip: If Lock without VPN option is missing, look in general security settings or advanced profile menus. Some manufacturers hide it under Additional options.

Expected result

After reboot, the VPN icon appears automatically. Any attempts to access the internet without an active VPN get blocked by the system.

✅ Check: Disable VPN in the app. Try opening a website—you should see a connection error until you re-enable VPN. Then connect again and confirm sites open properly.

Common issues and solutions

• VPN doesn’t start after reboot. Cause: battery restrictions or Always-on enabled for the wrong profile. Fix: review Step 1 battery settings and ensure Always-on is set for the correct profile.
• No Block without VPN option. Cause: UI hides it or device policy restrictions. Fix: use a VPN client with built-in kill-switch (e.g., OpenVPN for Android), or check Settings → Private DNS and disable conflicting configurations.

Step 4: Configure Per-app VPN System-wide and in Clients

Goal

Set so that either all apps use VPN, only selected apps, or all except excluded ones. Useful for banking, games, or local apps that shouldn’t route through VPN.

System Per-app settings on Android 15/16 (if available in your build)

1. Go to Settings → Network & internet → VPN.
2. Tap your VPN name and open Advanced settings. Some devices have a section called Apps using VPN or App exclusions.
3. If available, select apps to bypass VPN or those required to use VPN. Save changes.

Note: Availability of system app lists for Per-app depends on manufacturer and VPN client. Stock Android often delegates this function to the VPN app itself. Next, we cover guaranteed methods inside WireGuard and OpenVPN clients.

Per-app in WireGuard

1. Open WireGuard → tap profile → pencil icon (Edit).
2. Scroll to Tunnel Settings. Find Allowed applications or Apps using VPN. It may be inside a submenu depending on client version.
3. Add apps that MUST use VPN (if using allow-list mode) or set excluded apps (if opposite). Save.
4. Disable and re-enable the profile to apply changes.

Per-app in OpenVPN for Android

1. Open OpenVPN for Android → long-press profile → Edit.
2. Go to Behavior or Routing section (sometimes Apps).
3. Open App management. Choose Only selected apps use VPN mode or Exclude selected from VPN mode. Check desired apps and save.
4. Reconnect profile for changes to take effect.

Tip: Unsure which mode to start with? Use Exclude from VPN mode for banking and local service apps where geoblocking or anti-fraud may apply.

Expected result

You’ve set which apps route through the tunnel and which don’t. The system and client enforce these rules reliably.

✅ Check: Open an excluded app and verify its external IP via built-in browser or connection check button if available. Then open an app forced through VPN and confirm its IP matches the VPN.

Common issues and fixes

• Per-app not visible in WireGuard. Cause: client version or build. Fix: update the client or use OpenVPN for Android which offers flexible Per-app features.
• App still routes through VPN. Cause: routing cache or client quirks. Fix: reconnect profile, restart app, clear app cache, then retest.

Step 5: Work Profiles and Multi-User Scenarios

Goal

Set up VPN for work profiles, secondary users, or child modes without conflicting policies or tunnel drops.

Managed Profile and Always-on

1. If your phone is managed by IT via corporate agent, open Work Settings or Device Management app.
2. Go to network or VPN policy. Find Always-on VPN for the work profile.
3. Select the managed VPN app and enable Block without VPN within the profile. Save the policy.
4. Sync the device with management server and wait for policy application.

If you’re an IT admin, the Device Policy Controller can programmatically enforce Always-on and lockdown, possibly locking user settings or making them read-only.

Multi-user mode

1. Open Settings → System → Multiple users and enable if needed.
2. Create a second user and switch to it.
3. Install the VPN client separately and configure its own profile. Each user has independent VPN settings including Always-on and lockdown.
4. Repeat for the main user if different policies are desired.

Tip: For kids, set Always-on and lockdown plus restrict settings changes via Child Profile or Family Link to ensure traffic always goes through filtering servers.

Expected result

Work and personal profiles each use their own VPN profiles and rules. Policy conflicts are minimized, and tunnels remain stable.

✅ Check: Switch users or profiles and verify VPN status and external IP. Confirm that work profile blocks traffic when VPN is off.

Common issues and fixes

• User can’t see lockdown option. Cause: policy locked the setting. Fix: adjust policy via DPC or contact administrator.
• Switching users drops VPN tunnel. Cause: each user has separate network stack. Fix: expected behavior; configure Always-on for each profile individually.

Step 6: Test Traffic, Tune MTU, and Diagnose Leaks

Goal

Ensure VPN runs fast and secure, with no DNS or IPv6 leaks, properly tuned MTU, and stable connections on Android 15/16 meeting your expectations.

Speed and ping tests

1. Connect VPN.
2. Use a speed test app from a known provider or your browser’s built-in speed test.
3. Measure ping, download, and upload speeds. Save results.
4. Disconnect VPN and test again on the same network. Compare results.

5–25% speed drop with VPN is normal, depending on server, routing, and protocol. WireGuard is usually faster and more battery-friendly than OpenVPN.

Check for DNS and IPv6 leaks

1. Connect VPN.
2. Visit browser-based IP and DNS leak test sites. Observe which DNS resolvers are visible.
3. If you see your mobile provider’s public DNS instead of the VPN’s DNS, enforce DNS servers in the client (OpenVPN for Android) or server config (WireGuard, OpenVPN push DNS).
4. Check for IPv6 address. If the server doesn’t provide IPv6 but your network does, ensure your client blocks IPv6 leaks. In WireGuard, disable IPv6 in AllowedIPs or route ::/0 properly.

Tip: The most reliable way to avoid DNS leaks is to configure the resolver on the server and push DNS addresses via client config. Use dhcp-option DNS in OpenVPN or route all traffic through the server and set DNS inside the WireGuard app.

MTU tuning for stability

1. If you experience disconnects or slow-loading websites, reduce MTU by 20–40 bytes below default. For WireGuard clients, MTU between 1280 and 1380 often helps.
2. In WireGuard Android: open profile → Edit → Advanced → MTU, enter 1280. Save and reconnect.
3. In OpenVPN for Android: profile → Edit → Settings → MSS-fix or fragment/tun-mtu options if server supports. Test step by step.

Tip: Check that your router or mobile carrier isn’t interfering by lowering MTU. Sometimes mobile networks cause issues while Wi-Fi is stable.

Expected result

Speed matches expectations, DNS requests go through VPN, IPv6 leaks are blocked, MTU is optimized, and connection is stable without weird issues.

✅ Check: Repeat speed and DNS tests after adjusting MTU. If performance worsens, revert to previous settings.

Common issues and solutions

• DNS leaks persist. Cause: client ignores DNS from profile. Fix: specify DNS in app or server, ensure full routing for 0.0.0.0/0 and ::/0.
• Some games don’t work via VPN. Cause: anti-cheat or geo blocks. Fix: exclude the game app in Per-app or use a server closer to the gaming data center.

Verifying Your Setup

Checklist

• You can manually connect and disconnect the VPN.
• Always-on is enabled and works after reboot.
• Lockdown is enabled; no internet without VPN.
• Per-app rules apply and exclusions work.
• No DNS/IPv6 leaks; MTU is properly set.
• Work profile policies don’t conflict.

How to test

1. Reboot your phone and confirm VPN icon appears without manual action.
2. Disable VPN and verify internet access is blocked (if lockdown enabled).
3. Check IP inside excluded apps and VPN-routed apps; IPs should differ as expected.
4. Run speed and DNS leak tests.

Success indicators

• Switching Wi-Fi/mobile data doesn’t break tunnel beyond a few seconds.
• No spikes in VPN client battery usage.
• Excluded apps work reliably with their normal regional connections.

Common Mistakes and Fixes

• Issue: VPN doesn’t auto-start. Cause: wrong profile set for Always-on. Fix: Go to Settings → Network & internet → VPN → select correct profile and enable Always-on there; disable it on old profile.
• Issue: Internet works with VPN off despite lockdown enabled. Cause: option disabled after update or different active profile without lockdown. Fix: check Block without VPN flag on active profile, reboot.
• Issue: App ignores Per-app setting. Cause: routing cache or client limits. Fix: update VPN client, clear app cache, restart phone, reapply rules.
• Issue: Slow VPN speeds. Cause: overloaded server, unsuitable protocol, large packets. Fix: switch to a nearer server, try WireGuard, adjust MTU to 1280–1380.
• Issue: Local network devices unreachable. Cause: all traffic forced through VPN tunnel. Fix: add local network subnets (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) to client exclusions or use split tunneling.
• Issue: Banking app blocks VPN. Cause: anti-fraud or regional restrictions. Fix: exclude banking app in Per-app, restart app, log in again.
• Issue: Disconnects when screen locks. Cause: aggressive battery saver. Fix: set VPN app battery mode to Unrestricted, disable vendor optimizations, allow background activity.

Extra Features and Advanced Settings

Smart split tunneling

For fine routing control, combine system exclusions and client rules. For example, route all traffic through VPN, but whitelist local subnets and banking apps. This minimizes leaks and ensures predictable behavior.

Automation

• Tasker or similar can toggle profiles based on Wi-Fi connection.
• Some clients offer Quick Settings Tiles for easy profile control.

Streaming optimization

• Pick a server nearest to your favorite CDN.
• Use UDP with OpenVPN if no blocks exist; use TCP for unstable networks but note overhead.

IPv6 compatibility

• If your provider and server support IPv6, ensure ::/0 routing is included in your profile.
• If not, block IPv6 on the client to prevent leaks.

Fine-tuning OpenVPN

• Enable compression only if needed; usually better off.
• Use reneg-sec sparingly on mobile networks; keep default keepalive.

For VPN developers: Android 15/16 considerations

• Per-app and Always-on still rely on VpnService. Handle Builder.setAllowedApplications and Builder.addDisallowedApplication per usage patterns. Test against targetSdk 35/36 considering background service and notification restrictions.
• Account for battery policies and foreground service requirements. Initiate foreground notifications for active tunnels and respond correctly to network changes.
• Test compatibility with Work Profile and multi-user setups. Separate key stores and credentials by profile.
• Implement DNS robustly, especially with system DoH/DoT. Transparently expose which resolvers run inside the tunnel.
• Test behavior with system lockdown enabled and while switching Always-on between profiles.

Note: API changes for Android 15/16 vary by build and vendor. Stable VpnService models and allowed/disallowed packages, foreground notifications, and profile handling still apply. Key risks stem from stricter background activity and security policies with each Android version—test clients thoroughly at your target SDK levels against all guide scenarios.

FAQ

Q: How do I enable Always-on VPN on Android 16 if the option isn’t visible?
A: Go to Settings → Network & internet → VPN → gear icon on your profile → enable Always-on VPN. If missing, check Advanced or update your VPN app.

Q: How to set up Per-app VPN if no app list shows in system settings?
A: Configure Per-app inside the client. In WireGuard, open profile → Edit → Allowed apps. In OpenVPN for Android, use App management to set exclusions.

Q: WireGuard or OpenVPN — which to choose?
A: Start with WireGuard. It’s faster, simpler, and more battery-efficient. Use OpenVPN for legacy server compatibility or special features.

Q: Why do I need Block without VPN?
A: To prevent traffic leaks during VPN interruptions. Essential for privacy or corporate policy compliance.

Q: Why won’t banking apps work over VPN?
A: Due to anti-fraud or geoblocking. Exclude the banking app in Per-app settings and reconnect.

Q: Is Private DNS needed with VPN?
A: Usually no. It’s better to use DNS servers provided by the VPN to avoid leaks and inconsistent results.

Q: How to import IKEv2 profile?
A: Go to Settings → VPN → Add VPN → choose IKEv2/IPSec, enter server, IDs, keys or certs, save, then connect and verify IP.

Q: What to do about disconnects on mobile networks?
A: Enable unrestricted data access for the client, disable aggressive battery saving, lower MTU to 1280, and select a nearby server.

Q: Can I share VPN internet via hotspot?
A: Android generally doesn’t route VPN traffic through hotspots. It depends on device and client. Consider client-level VPN or router-based VPN instead.

Q: How to switch servers quickly?
A: Create multiple profiles for different cities in your client and add Quick Settings tiles. Switch with two taps.

Conclusion

You’ve completed a full VPN setup cycle on Android 15/16: installed and connected clients, enabled Always-on, activated lockdown mode, configured Per-app rules, set personal and work profiles, optimized performance, and verified no leaks. Now your phone reliably and securely uses VPN, automatically restoring protection after reboot and blocking any traffic outside the tunnel. For predictable dedicated IPs and ready-to-go configs across protocols, consider a personal server from a trusted provider offering custom settings and rapid deployment. From here, you can dive into automation, write server-side monitoring scripts, fine-tune split tunneling, and test upcoming Android versions to stay ahead of background service and profile policy changes. You’ve built a solid security foundation on your Android.

Tip: Monthly, open your VPN settings to ensure profiles are current and updates haven’t reset key flags like Always-on or Block without VPN.

⚠️ Warning: Editing profiles temporarily drops the tunnel for a few seconds. Before making major changes, switch to Wi-Fi and temporarily disable lockdown to avoid losing access to critical services. Re-enable lockdown afterward.

✅ Final check: After reboot, verify VPN icon appears automatically, websites load, and excluded apps connect directly as configured.