Before setting up a VPN on Android, understand the difference between a client, a subscription, and system permissions. The client connects to the VPN; the subscription provides route configurations; and Android's VPN permission lets the app manage network traffic. Importing a subscription is only the first step. You still need to select a route, connect, and check whether your apps follow the intended rules.
Follow the steps below in order. Button names vary between clients and Android versions; terms such as “subscription,” “configuration,” and “connect” refer to common options, not identical screens. If you're using VPNRoll, start with the getting started guide, then check the download section in the user panel for the current client and supported subscription formats.
Before installing: check the client and subscription format
Don't choose an installer based on the app name alone. Check the service's client guide for Android version requirements, download sources, and supported subscription formats. Prefer official project release pages or trusted app stores listed in the guide. Avoid installers with matching names found in search ads or forwarded chat attachments.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocols or protocol suites, not interchangeable import options. Whether a client can read them also depends on its core, version, and configuration format. Support for one protocol doesn't mean an app can import every subscription. Don't change encryption, transport, or certificate verification settings at random to fix an import failure.
| Item | Purpose | Check |
|---|---|---|
| Android app package | Install and run the client | From a trusted source and compatible with your system and device |
| Subscription URL | Get route configurations and update them later | Matches the client's format; URL is complete |
| Configuration file | Import rules, routes, and related settings | The client supports this file format |
| Node share link | Import the details for a single route | May not include routing rules or automatic updates |
If Android asks you to let the browser “install unknown apps,” verify the source before granting permission to that installer. You can turn the permission off again in Settings afterward. This permission is for installing apps; it is separate from the VPN permission requested when you connect. If Android shows a security warning, check the file and release notes rather than disabling security protections altogether.
Import a subscription: copy it from the panel into your configuration list
Sign in to the VPNRoll user panel and follow its instructions to get your subscription. The URL may contain credentials that identify your account, so protect it like a password. Don't post it in public groups for help or submit it to untrusted online conversion tools.
- Copy the subscription. In the panel, find “Subscription” or the option for your client, then use the copy button. If multiple formats are available, choose the one specified for your client.
- Open the import option. Go to the client’s “Configuration” or “Subscription” page and look for “Add,” “Import from URL,” or “Import from clipboard.” Don't paste a subscription URL into a server address field for a single node.
- Save and update. Paste the full URL, enter a name you’ll recognize, and tap “Save” or “OK.” Then select “Update” or “Download configuration.” Some clients fetch the subscription as soon as you save it.
- Activate the configuration. Check that routes or policy groups appear in the list, then select the configuration you just imported. Saving a subscription entry doesn't automatically make it the active configuration.
Treat “import successful” and “update successful” as separate steps. The first may only mean the client accepted the URL; the second means it fetched and parsed the configuration. If the list is still empty, check the update log to see whether the URL is invalid, the download failed, or the format isn't supported.
Connect: approve Android's VPN request
Select a route in the active configuration, then tap “Connect,” “Start,” or the toggle. The first time a VPN connects on Android, the system usually displays a “VPN connection request” explaining that the app can manage network traffic. Make sure the app name matches the client you installed, then tap “OK” or “Allow.”
If you tap Cancel by mistake, return to the client and try connecting again. Once permission is granted, Android may show a key icon or a VPN notification. These indicate that the VPN interface is active, but they don't prove that every app is using the selected route or that the site you want is reachable.
Some clients offer both local proxy and VPN modes. To route traffic from the apps you use on your device, follow the client’s instructions to enable VPN or virtual network adapter mode. Simply opening a local proxy port usually won't change how apps other than a browser connect unless they’re configured to use that proxy.
An existing VPN, an ad blocker that uses Android's VPN interface, or a work profile's network settings may cause conflicts. Check which service is active, then pause conflicting services to test. Don't treat “Always-on VPN” or “Block connections without VPN” as required for your first connection. Enabling blocking before testing your setup can make network issues harder to diagnose.
Keep the client running in the background: adjust battery restrictions
If the connection works while the screen is on but drops after you lock it, check battery management first. Long-press the client icon, open “App info,” then look for “Battery” or “App battery management.” Check for options such as “Unrestricted,” “Allow background activity,” or “Don't optimize.” Names and menus vary by device maker. If you can't find them, search Settings for the app name or “battery optimization.”
Some Android versions also manage “Autostart” and “Background activity” separately. Allow these only if the app is being stopped in the background, and follow your device’s instructions. Don't grant unrelated permissions just to keep the client running. If the client needs notification permission to show connection status, you can allow it, but notifications alone won't prevent Android from stopping the app.
- ✅ The app's battery settings allow the background activity it needs.
- ✅ The client hasn't been force-stopped or closed using a cleaner app.
- ✅ After locking the screen, reopen the app you want to use and confirm it still works.
- ✅ After switching from Wi-Fi to mobile data, check whether the client needs to reconnect.
These settings may increase background battery use, so decide whether to keep them based on how you use the app. Don't rely on the notification alone: a running process, an active tunnel, and a working app are three different things.
Verify the connection: exit IP, DNS, and your apps
Check your exit IP first, then review the routing rules
Before connecting, open a trusted IP lookup site in your browser and note the exit IP it shows. Connect and refresh the same page to compare. If the site is set to use a direct connection by your rules, the IP may stay the same. Check whether the domain should go through the proxy instead of assuming the entire client has failed.
Rule-based mode chooses a route based on domains, addresses, or other conditions. “Global” mode usually means managed traffic prefers the selected proxy; it doesn't automatically override app exclusions or bypass settings. If you switch modes temporarily for testing, restore your original rules afterward to avoid changing how local services and other apps connect.
Check DNS, but don't rely on the resolver's location alone
A DNS check shows which resolvers handle your domain lookups. Seeing a resolver in another region doesn't by itself prove there's a leak: public DNS services may use distributed servers, and location databases can be inaccurate. What matters is whether requests follow the expected route and whether queries that should be protected by the proxy are bypassing your configuration.
Android Private DNS, a browser's Secure DNS, and the client's own DNS settings can all affect results. If something looks wrong, note your original settings, change one thing at a time, and test again. Don't turn everything off at once. If your device supports IPv6, check whether the client routes or otherwise handles that traffic properly; an IPv4-only test isn't enough to draw a conclusion.
Finally, test the app you actually want to use
After the browser test succeeds, return to your target app and refresh its content or reconnect. If the browser works but the app doesn't, check “Per-app proxy,” “Bypass apps,” or the app list in your client. Some lists include only the selected apps in the proxy; others exclude them—the opposite behavior.
If the client provides connection logs, use the domain and matched rule to help diagnose the issue. Don't share full logs containing credentials. Account region settings, cached data, and platform policies can also affect access, so not every error is caused by the route. Once you confirm traffic is routed correctly, investigate the account or app itself.
Common issues: narrow down the cause by symptom
Routes appear in the subscription, but connecting immediately fails: Start with the exact error. An incompatible configuration syntax, missing protocol support, and an unreachable server are different problems. Check that the client version supports the subscription format, then update it using the method in the service guide. Don't disable certificate verification to “fix” the connection.
No pages load after connecting: Disconnect and confirm your regular internet connection works. On public Wi-Fi that requires a sign-in page, complete the network's normal login first. Reconnect and check the selected route, DNS settings, and whether direct connections were accidentally blocked. Trying another route can help isolate the problem, but don't change all your settings at once.
Only one app can't connect: Check per-app settings and domain rules, then check the app itself. If you just changed a rule, close and reopen the app so it can establish a new connection. Don't start by clearing all app data; you may lose local content.
The connection stops working after locking the screen or switching networks: Recheck background restrictions and see whether the client log shows failed reconnections. If reconnecting manually fixes it, tell support what triggered the issue and which system your device uses instead of simply saying “it won't connect.”
For help, submit a support ticket in the user panel with the client name and version, system details, error message, and whether the issue happened on Wi-Fi or mobile data. Hide your subscription URL, account credentials, and personal information in screenshots. Specify whether the issue occurs during installation, subscription retrieval, connection, or app testing to make troubleshooting more efficient.
You don't need to reinstall everything for routine use. Keep a working configuration, update subscriptions according to the guide, and note your original settings before making changes. That way, if something goes wrong, you can return to a known-good setup instead of starting from scratch.