This beginner’s guide walks you through setting up an Android VPN in the right order: install the right client, import a subscription, grant connection permissions, then verify access and background operation. Don’t treat “Connected” as the finish line. Setup is complete only when the intended apps use the expected route and the connection recovers after locking your screen or switching networks.
Understand the difference between a client, a subscription, and system permissions
A client is the app that runs your connection configuration. A subscription link provides access to routes and rules, while Android’s VPN permission lets the client create a virtual network interface. These serve different purposes: installing the app won’t automatically give it routes, and importing a subscription doesn’t mean Android has allowed it to handle traffic.
Many Android proxy clients use Android’s VPN interface to handle app traffic, but how traffic is routed depends on the client, proxy mode, and rules. A VPN icon in the status bar means the system has an active VPN connection; it doesn’t prove that every app uses a remote exit or that DNS isn’t leaking.
- ✅ Get the client from a trusted source, and verify the app name and publisher first.
- ✅ Sign in to the dashboard to get a subscription compatible with your client. Avoid shared configurations from unknown sources.
- ✅ Keep your current network settings. Get the basic connection working before changing routing rules or background options.
- ❌ Never post subscription links, account passwords, or screenshots containing credentials in public groups.
VPN86 doesn’t require an email address; you can create an account with a username and password. Sign in to get the client and subscription. The Android client is available to download after signing in. Visit the client downloads page to see the current options. Don’t judge whether an app is genuine by relying on similar names in search results.
Install the client and check its source and compatibility
Use the distribution channel provided in the dashboard whenever possible. If you install from a package file, Android may ask you to allow the current browser or file manager to install unknown apps. Grant permission only to the source you’re using for this installation, then turn it off afterward. There’s no need to enable installation permissions for other apps.
If installation fails, start with the system message. An unsupported Android version, an incomplete download, or a signing key that differs from the installed version can all cause problems. Don’t repeatedly try unknown installation files to force an update. Before uninstalling an older version, make sure you can retrieve your subscription again and save any rules you’ve customized.
Whether a client supports the protocols in your subscription depends on its version and core. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC aren’t interchangeable names. Being able to import a link doesn’t mean the client can run every protocol in it. Hysteria2 and TUIC, in particular, rely on QUIC and may be affected by restrictions on UDP traffic on your current network. Check the compatibility notes before trying a different protocol.
Import the subscription and check that it updates
Choose a subscription format in the dashboard that matches your client. The import option may be called “Subscription,” “Configuration,” or “Profile”; names vary between apps. Before opening an import link, check that Android is handing it to the intended app. If that doesn’t work, copy the link and add it manually instead.
- Copy the complete subscription link from the dashboard. Make sure you don’t miss query parameters or include leading or trailing spaces.
- Add a remote subscription in the client, give it a descriptive local name, and save it.
- Update or download the configuration, and check for authentication, parsing, or network errors.
- Open the route list and make sure the imported configurations are selectable, then choose the route you want to use.
Subscription links usually contain access credentials, so treat them like passwords. Don’t paste them into public conversion websites or send the full URL when troubleshooting. If you think a link has been exposed, reset it in the dashboard if that option is available, then update the subscription on each device.
“Update subscription” and “Start connection” are separate actions. Updating fetches the current configuration; starting establishes an actual connection. If the subscription won’t update, first check whether your local network can reach the dashboard, then verify your account status and that the link is still valid. Repeatedly starting the VPN won’t necessarily fix a subscription download problem.
Grant connection permissions and choose sensible routing rules
The first time you start the client, Android usually displays a system connection request explaining that the app can handle network traffic through the VPN interface. Check the app name before approving it. If tapping Start does nothing, check for another dialog covering the screen, another VPN app already using the connection, or restrictions imposed by a work profile or device management policy.
Ad blockers, enterprise access apps, and proxy clients that use Android’s VPN interface may conflict; don’t assume they can all run at once. Turn off other similar connections and test the current client on its own. If you need to work with an enterprise network, follow your administrator’s instructions rather than trying to bypass management policies.
For your first connection, keep the client’s recommended rule mode. Rule-based routing uses conditions such as domains, addresses, or apps to decide whether traffic connects directly or uses a proxy. Global mode usually routes traffic handled by the client through the selected proxy, but excluded apps, system restrictions, and implementation details can still affect the result. If an app isn’t working as expected, check whether it’s on the bypass list.
“Always-on VPN” and “Block connections without VPN” are system-level options. The latter may block internet access if the connection drops or the configuration stops working, so it isn’t a general-purpose fix. Verify your basic connection first and make sure you know how to turn the option off before enabling it. For more on protocols and routing, see the protocol reference.
Adjust battery settings to troubleshoot disconnections when the screen is locked
If the VPN works in the foreground but stops working after you lock the screen, background process restrictions are a common cause—but don’t assume that’s the problem without checking. Android settings and battery management menus vary by device maker. Look in the app’s settings for options such as “Battery,” “Background activity,” or “Unrestricted,” and allow the client to maintain its connection in the background. Some devices also have an auto-start setting; adjust it as recommended by the client.
If Android requires an ongoing notification for the foreground service, keep it enabled so you can monitor the client’s status. Allowing background activity doesn’t mean the app will use resources without limits or stay active in every system environment. Test it by locking and unlocking the screen and switching networks.
To test, first make sure the app you want to use can access the internet. Lock the screen, unlock it, and continue in the same app. Then switch between Wi-Fi and mobile data and see whether the client reconnects. Don’t rely on whether an old page still appears to load; cached content may remain available offline. Try a new search, refresh, or another action that clearly requires an internet connection.
If the problem occurs only after switching networks, it may be related to reconnecting, UDP support on the network, or reachability of the entry point. Reconnect, then compare with another compatible route. Focus on battery settings only if you’ve confirmed that the process was terminated.
Verify it works: check your IP, apps and DNS routing
Verify the connection using more than one indicator. First, note the results of a network check before connecting. Then start the client and use the network test page to check your browser’s exit IP. Note: in rule mode, the test site may connect directly, so an unchanged exit IP doesn’t prove that the entire VPN is down. Check the matching rule or the client’s connection log as well.
Next, test the app you actually want to use. If the browser works but another app doesn’t, the app may be excluded, its domain may not match a rule, it may be holding on to an old connection, or the service itself may have restrictions. Restarting the app and making a new request is often more useful than repeatedly refreshing an already open page.
| What you observe | What it doesn’t prove | What to check |
|---|---|---|
| The client says it’s connected | Every app is using a remote route | Check Android’s VPN status and test access in the app you want to use |
| The browser’s exit IP hasn’t changed | The subscription or route is definitely unavailable | Check whether the test domain matches a direct-connection rule |
| The browser works, but an app doesn’t | The remote route is down entirely | Check app routing rules, existing connections, and restrictions on the destination service |
| New requests fail after the screen is locked | Battery settings must be the cause | Compare process status, network changes, and reconnection results |
| A DNS test shows a local resolver | All browsing activity has leaked | Check DNS rules, Private DNS, and browser settings |
A DNS leak occurs when domain queries that are expected to use a particular route are sent through another route instead. Android Private DNS, a browser’s Secure DNS, DNS handling by the client, and routing rules can all affect test results. A resolver’s name or reported location is a clue, not a complete diagnosis.
Don’t permanently turn off encrypted DNS as soon as a result looks unusual. A safer approach is to save your current settings, follow the client’s instructions, and change one option at a time, checking the result after each change. DNS queries don’t necessarily follow the same route as web traffic, so don’t mistake a resolver’s location for your actual exit location.
Setup is complete when: the app you want to use can make new requests, routing behaves as expected, the DNS path is understood, and the connection recovers after you lock the screen or switch networks. A “Connected” indicator alone isn’t enough.
Troubleshoot connection problems step by step instead of reinstalling repeatedly
Check your basic internet connection first, then subscription updates, system permissions, the route connection, and app routing. If ordinary websites won’t load even without the VPN, troubleshoot your local network first. If the subscription can’t be parsed, check its format and client compatibility. If the route connects but a specific service doesn’t work, check the rules and the destination platform’s requirements.
Route names alone don’t diagnose a problem. Direct connection usually means the client connects straight to a remote entry point. A relay adds another forwarding step, while an IEPL line describes a specific dedicated transport arrangement. These are different from proxy protocols. The name alone can’t tell you the full path from your device to a website or guarantee that every app will work. Refer to the route list and notes in the dashboard for details.
If you need help, note the client name and version, Android version, selected configuration type, and whether the problem occurs during import, connection, or actual access. You can share a redacted error message, but remove subscription tokens, passwords, and credentials from the full configuration. Reproducible details such as “Wi-Fi works, but the connection fails after switching networks” are more helpful than simply saying “it doesn’t work.”
Choose a plan based on your actual usage and keep troubleshooting notes
Once setup and testing are complete, choose a billing option that fits your usage. VPN86 monthly plans are ¥9.9/month for 60GB, ¥18/month for 250GB, and ¥28/month for 500GB. Data resets monthly on the activation date; mid-cycle upgrades are prorated by the remaining days. If you don’t use the service continuously, compare these with data packages that remain valid until used up and never expire. See the plans page for current prices.
VPN86 supports unlimited devices, but device count and data allowance are separate: unlimited devices doesn’t mean unlimited data. Each device still needs its own configuration, system permissions, and connection checks. VPN86’s privacy policy states that it keeps no logs; that policy doesn’t replace checking the client’s source, system permissions, and local configuration.
You can request a full refund for any reason within 30 days of your first payment. Keep notes on key settings and issues during testing so you can follow the same checks when changing devices or updating the client, rather than guessing what each setting does all over again.