When setting up an Android VPN, seeing a key icon isn't enough. The client must load a valid subscription, establish the system tunnel, and route the right requests through the intended exit. Follow these steps in order. Menu names vary by device, so check your manufacturer's instructions.
Before You Install: Understand Clients and Subscriptions
An Android client is an app that reads configuration, connects to servers, and applies routing rules. A subscription link provides server configurations and typically contains account information. Installing an app doesn't automatically give you working servers; a subscription still needs a client that supports its format and protocols.
Open the client downloads section in the VPNQO panel, choose an app for Android as directed, then get the matching subscription. Don't install an app based on a similar name alone or import a configuration made for another platform. If you download an APK, verify its source and package details to avoid repackaged versions from untrusted sites.
| Item | Purpose | What to check |
|---|---|---|
| Android client | Establishes the connection and applies configuration | Check that the Android version, device architecture, and configuration format are compatible |
| Subscription link | Provides servers, groups, and sometimes routing rules | Check that it belongs to your account and works with the selected client |
| Android VPN permission | Allows the app to route network traffic through the system interface | Check that the app name in the permission prompt is correct |
| Exit verification | Checks the public IP address used by a specific request | Check whether the request went through the proxy or was routed directly by a rule |
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different proxy protocols, not universal file formats. Support for one protocol doesn't mean a client can read every subscription format. Compatibility depends on the client core and version; check the panel's instructions. Don't change encryption or transport settings at random just to make an import work.
Install and Import: Load the Full Configuration First
- Install the app. If you download an APK in your browser, Android may ask you to allow installs from that source. Grant permission temporarily only for a trusted source, then turn it off after installation. This is separate from the VPN permission you'll need later.
- Copy the right subscription. Find the subscription section in the VPNQO panel and choose a format supported by your client. Copy the full link, including its trailing parameters. Don't use the panel login page URL as the subscription link.
- Add a remote configuration. In the client, open the configuration, subscription, or profiles page and choose import from link. Enter a name if needed, paste the subscription link, save, and update it.
- Check the update. Make sure servers and proxy groups appear. Some clients require you to select the newly imported configuration separately; saving it doesn't necessarily enable it.
One-tap import usually relies on your browser opening the client, so a failed import doesn't necessarily mean the subscription is invalid. Try copying and pasting the link manually. For a format error, check the subscription type; for a download timeout, check whether your current network can reach the subscription URL. Avoid repeatedly deleting the app, which can erase existing settings and troubleshooting clues.
Some apps can import from the clipboard; others require you to save the configuration as a remote file. Follow the app's interface rather than looking for an exact button name. After importing a local file, automatic updates depend on whether the remote source is retained. A local copy isn't the same as a remote subscription.
First Connection: Permissions, Exit, and Routing Mode
Enable the configuration, choose an exit region in the proxy group, and start the connection. The first time, Android will show a VPN connection request. This means the app will handle traffic through Android's VPN interface. Check the app name and approve the request. If you deny permission, the app may still show its server list, but it can't route your device's network traffic.
Android generally allows only one active VPN service per user or work profile. Ad blockers, firewalls, and other proxy apps that use the system VPN interface may conflict with your client. If your connection is immediately replaced, check Android's VPN settings instead of repeatedly tapping Connect.
Use Rule Mode for Everyday Browsing
Rule mode decides whether requests connect directly or use a proxy based on domains, addresses, or other criteria. It's useful for keeping local services accessible. Global proxy mode typically sends more traffic handled by the client through the selected proxy group, making it useful for temporary troubleshooting. However, app exclusions, routing, and system settings may still affect traffic; it doesn't guarantee that every connection on the device goes through the tunnel.
If your client offers options such as “Proxy selected apps only” or “Bypass selected apps,” read them carefully. If your browser is excluded, an IP check in that browser may show your local exit even when other apps use the proxy. Keep app routing simple for the initial test, then adjust it after confirming the connection.
Use the configuration provided for your client in the panel, rule mode, and a clearly selected exit region. Confirm that this setup works before adding custom DNS, app exclusions, or complex rules. Changing several settings at once makes it harder to pinpoint problems.
Battery Settings: Prevent Disconnects in the Background
Android manufacturers handle background apps differently. If the connection works while the app is open but drops when the screen locks, the system may be restricting the process rather than the server failing. Open the app's battery settings and allow background activity, choose unrestricted use, or select a similar option. If your device has an auto-start manager, make sure it doesn't block the client from starting automatically.
Adding a client to the battery-optimization exemption list doesn't disable all battery protections. It reduces the chance that the system will stop the app when it's idle. Locking the app from the recent-apps screen can help, but it doesn't replace battery permissions. Check these settings again after a system update, device migration, or app reinstall.
- ✅ The client is allowed to run in the background and isn't restricted by battery settings.
- ✅ If Data Saver is on, check that the client is allowed to use background data.
- ✅ Enable any notification permissions the client requires to show connection status and disconnection details.
- ✅ Reopen the app you want to use after locking the screen and confirm the connection stays active or resumes normally.
Android's “Always-on VPN” can keep a connection active, but the client must support automatic reconnection. “Block connections without VPN” may cut off network access if the tunnel drops, so don't enable it before you've verified your initial setup. If you lose all connectivity after turning it on, check the Android VPN settings first instead of resetting all network settings.
Verify Your Connection: Check the Exit and DNS Routing
A VPN icon in the status bar only shows that the system interface is enabled. It doesn't prove that the remote connection or every routing rule is working. Check the client status, exit IP, and access to the site you need. Don't rely only on a server test button: its requests may take a different route from those of the app you're using.
- Check the client. Confirm that it shows a connected status and look for handshake failures, DNS errors, or timeouts. If connection logs are available, open the site you want to test and see which group handled the request.
- Check your exit IP. Open the IP lookup page and compare the result with your selected exit region. In rule mode, the page may connect directly, so check its routing first. If needed, temporarily switch to global proxy mode for comparison, then restore your usual rules.
- Test what you need to do. Open the site and check that pages load, you can sign in, or files open as expected. If the exit region is correct but the site still denies access, the cause may be your account's region, the site's policies, or how it identifies exit IPs.
- Test network changes. Switch between Wi-Fi and mobile data, see whether the client reconnects, then test the app you want to use rather than relying on the VPN icon alone.
A Changed IP Doesn't Confirm Your DNS Settings
DNS translates domain names into IP addresses. If queries bypass the expected route, the domains you visit may be exposed, or results may not match your exit region. Browser secure DNS, Android Private DNS, and the client's DNS settings can each use different routes. A DNS server's country alone can't tell you whether there's a leak; compare the results with your intended setup and the client's logs.
For your first setup, use the DNS settings supplied with the compatible subscription. If domain lookups fail, note the current settings and check Private DNS and secure DNS in your browser one at a time. Don't treat disabling these protections as a long-term fix. A DNS test page usually reflects only the browser test, not how every app handles DNS.
Common Issues: Troubleshoot by Failure Point
Subscription update fails, but other websites work
First determine whether the issue is a format parsing error or a network request failure. For a parsing error, check the subscription type and client version. For a request failure, make sure the link is complete, your account is active, and your device's clock is accurate. Don't bypass the error by disabling certificate checks, and never paste your real subscription link into an unfamiliar testing site.
The server connects, but no websites will load
Check that you haven't selected a direct, blocked, or unavailable proxy group, then review DNS errors and connection logs. Once you've confirmed your network itself works, try another exit and compare the results. If only Wi-Fi is affected, check whether you need to complete a captive portal sign-in first.
Only one app can't connect
Check whether the app is on a bypass list and whether its domain matches the wrong rule. Browser access doesn't prove that every request from another app works; it may use additional endpoints. Streaming services and AI tools may also restrict access by region or account, so a successful VPN connection doesn't guarantee continued access to third-party services.
Will switching to a dedicated line solve the problem?
IEPL, transit, and direct connections describe network paths or transport methods, not client import formats. Different paths can affect performance across networks, but they can't fix a broken subscription, missing system permission, or incorrect routing rule. Rule out local configuration issues first, then compare routes for your actual needs.
The configuration updates successfully, system permission is active, requests match the expected rules, the exit check makes sense, and the connection works after locking the screen or changing networks. Together, these checks show that your Android VPN is set up—not just that the app says “Connected.”