This Android VPN setup guide walks you through installing a client and confirming that your chosen apps are using the expected route. The key is not just seeing “Connected”—it’s making sure the client, subscription format, system permissions, and routing rules all work together. Android menu names vary by manufacturer, so the steps below focus on what each setting does rather than assuming a specific button layout.

Install a client: check the source and supported formats first

Android’s “Add VPN” setting is mainly for VPN types supported by the system; it is not a general-purpose subscription-link importer. Protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC usually require a compatible client. A “subscription” URL may return either a server list or a complete configuration, so don’t assume that every format works with every client.

For GMTVPN, sign in and visit the client downloads page in the dashboard, then follow the Android instructions to get a client. Sign-in is required to access your subscription. GMTVPN requires no email address; you can create an account with a username and password. Don’t rely on similar-looking search results to identify a legitimate download, and don’t paste your subscription into an unfamiliar online format converter.

If you downloaded an installation file, Android may ask you to allow your browser or file manager to “Install unknown apps.” Grant permission only to the source you’re using, and turn it off again after installation if you wish. If Android displays a security warning, check the source and file details instead of disabling all security checks just to proceed.

When you first open the client, check that it supports the import method provided in your dashboard. A “Proxy” switch does not necessarily mean the client supports every protocol in your subscription. Even clients that support the same protocol may differ in which transport settings they accept. If the dashboard lists recommended clients, follow its guidance to narrow down any issues.

Import a subscription: distinguish links, configs, and servers

A subscription link typically contains account-related credentials and can be used to retrieve server configurations. It is not a regular product page or a generic speed-test link. Copy it using the dashboard’s copy option to avoid missing trailing characters, adding spaces, or mistaking a page URL for the subscription URL.

  1. Copy the subscription link that matches your client from the dashboard. If there are format options, choose the one named for your client or specified in the dashboard instructions.
  2. In the client, open the configuration, subscription, or profiles page and choose the option to import from a URL. You can name it whatever you like, but keep the full URL intact.
  3. Save and update the subscription. Check that servers or a proxy group appear—you should see more than just a subscription name.
  4. Enable the imported configuration, select a server or proxy group, and then connect.

If the import fails, first check whether the error is a download failure or a parsing failure. For a download failure, check your network, confirm the link is still valid, and make sure the dashboard opens. A parsing failure is more likely to mean that the format or protocol isn’t supported. Don’t repeatedly delete all your data or change the client, subscription, and network at the same time before noting your original settings.

Updating a subscription and updating the app are two different things. A subscription update fetches changes to the server configuration; an app update adds features or improves compatibility. After updating the subscription, check that the selected proxy group still points to the server you expect. Don’t rely only on an “Update successful” message.

Grant VPN permissions: route the apps you need through the tunnel

When you tap Connect, Android will usually show a system prompt to approve the VPN connection. Check that the app making the request is the client you just installed, then allow the connection. This lets the app handle traffic through the VPN interface; it does not mean Android has verified the provider’s privacy policy or that every app will use the VPN.

Some clients offer both local proxy and VPN modes. Regular browsers and apps may not use your local proxy settings, so for first-time setup, follow the dashboard guide to enable the VPN or tunnel mode designed for Android. Don’t grant unrelated permissions, such as access to contacts or accessibility services, just to get connected.

If your device is already running another VPN, a local-VPN-based filter, or a security app, they may conflict. In general, multiple apps can’t maintain active VPN connections at the same time in the same user or work profile. Check which app currently owns the system VPN, then pause any conflicting app and test again. On a managed device, follow your organization’s requirements rather than trying to bypass its policies.

Choosing a routing mode and per-app proxy settings

Rule-based mode uses domains, addresses, or other configuration conditions to decide whether traffic goes direct, through the proxy, or is blocked. Per-app proxy settings determine which apps use the tunnel. Some clients use an allowlist and others a denylist, so selecting an app can mean opposite things in different clients. Read the on-screen explanation and make sure your target browser isn’t excluded.

For troubleshooting, you can temporarily switch to the client’s global proxy mode to see whether a rule is causing the issue. This may not include apps excluded by per-app settings. Once the connection works, restore your normal rules; a troubleshooting mode is not a privacy guarantee. Also understand Android’s “Always-on VPN” and “Block connections without VPN” settings separately: if the tunnel goes down, these options may leave the device without network access.

Add the client to the battery optimization exception list: check the connection after locking the screen

If things work in the foreground but stop after you lock the screen, check for restrictions on background activity or network access. Open the app’s system settings and look for battery, background activity, auto-start, or background data options. Allow the client to run in the background as needed. Menu names vary by manufacturer and Android version, so use the options shown on your device.

If the client needs a persistent notification to keep its foreground service running, follow its instructions and leave the notification enabled. Hiding a notification alone does not prove that the service has stopped. Some systems also let you lock an app in recent tasks; this may reduce the chance of it being cleared, but it does not replace battery settings or guarantee the client will keep running.

After changing settings, reconnect in the client, open the target website, lock the screen, then resume and check that the session still works. Next, switch from Wi-Fi to mobile data and see whether the client reconnects. A network change alters the underlying connection, and some sessions need to be re-established. A brief reconnection does not necessarily mean your subscription has stopped working.

If the connection fails only after switching networks, first check that the client is allowed to use mobile data and whether the new network requires a sign-in page. A VPN may not connect until you complete the sign-in on public Wi-Fi. Confirm that the network itself is working, then reconnect instead of repeatedly updating the subscription.

Verify the connection: check your exit IP, DNS, and target apps separately

Run checks in the same app for a fair comparison. Disconnect and check your current public IP and network access. Then reconnect, reopen an IP lookup page in the same browser, and compare the address and network details. If you use rule-based mode, make sure the lookup page is routed through the VPN; otherwise, seeing your local IP may be exactly what the rules are meant to do.

IP location depends on lookup databases, which may be outdated or inconsistent. Don’t diagnose a server problem based only on a map marker, and don’t assume that a changed IP proves all traffic is encrypted. Browser sign-in status, location permissions, and cached data can also affect the region or content a website displays.

A DNS check shows which resolver handles domain lookups. Depending on the client, queries may use remote DNS, local DNS, or different resolvers based on rules. Browser Secure DNS, Android Private DNS, and the client’s DNS settings can also interact. If the resolver differs from what you expected, check your configuration first; different resolver locations do not automatically mean there’s a leak.

Assess a DNS leak against your configuration: investigate further if queries that should go through the tunnel are still being sent to your local network’s resolver. A DNS test site can show what it observes, but it cannot prove how all traffic on your device is handled. Keep a record of the original settings and change one relevant option at a time so you don’t confuse a DNS issue with a routing issue.

Common issues: narrow down the cause by what you see

First distinguish between “the client won’t connect” and “an app won’t work after the client connects.” For the first, check the server, protocol compatibility, and network. For the second, check routing rules, app exclusions, and DNS. Keeping the error message is more useful than repeatedly reinstalling the app. When contacting support, include the client name, system environment, selected server, and steps to reproduce the issue—but hide your subscription credentials.

Choose the next check based on what you observe
What you see Check first What to do next
No servers appear after importing a subscription Check that the URL is complete and the format is supported Copy the matching format again from the dashboard and check for a download or parsing error.
No system prompt appears when you tap Connect Check whether permission was already granted and whether the client is in local proxy mode Check Android’s VPN settings and the client’s mode; a missing prompt does not necessarily mean the connection failed.
Connected, but the target app doesn’t work Check per-app exclusions, rule matches, and DNS Compare results in the same browser and temporarily switch modes to pinpoint a routing-rule issue.
The connection drops after locking the screen Check background activity, battery restrictions, and service status Allow the necessary background activity in system settings, then test again with the screen locked.
No internet access even after disconnecting the VPN Check whether non-VPN connections are blocked and whether the network requires sign-in Review the system VPN settings and confirm that the local network itself has internet access.

Trying another server can help determine whether the issue is specific to one route, but it won’t fix an invalid format or a client stopped by the system. IEPL, transit, and direct connections describe network routing arrangements; client permissions are a separate issue. Don’t use a route type as a substitute for checking your device, or assume performance based on a label alone.