How to use Always-on VPN on Android 14, 15, and 16

Android provides two related system controls for supported VPN apps. They are useful when you want the operating system to treat one VPN as the default network path, but they are not the same control.

Google’s Android VPN documentation describes Always-on VPN as a system feature that can start a VPN service when Android starts and keep it running. The VPN app remains responsible for establishing and maintaining its connection to the gateway.

Always-on VPN and traffic blocking

Always-on VPN improves service persistence. It does not, by itself, mean that non-VPN traffic is blocked. That stricter behavior comes from the separate blocking setting, sometimes called VPN lockdown in Android documentation.

How to find the settings

On many Android 14, 15, and 16 devices:

1. Open Settings.
2. Open Network & internet, Connections, or the equivalent network menu.
3. Select VPN.
4. Open the settings icon beside TuxlerVPN.
5. Enable Always-on VPN if it is available.
6. Optionally enable Block connections without VPN after considering the trade-offs below.

On Samsung devices, the path may appear under Settings > Connections > More connection settings > VPN. Other manufacturers use different labels. Android enterprise administrators can also control whether these options are available in a managed profile.

If TuxlerVPN does not appear in the VPN list, open the app and complete Android’s VPN permission prompt first. If a setting is absent or disabled, confirm that the installed app version and device configuration support it.

What happens during a network change

Moving between Wi-Fi and mobile data changes the outer network path used by the VPN. WireGuard is designed to accept authenticated packets from a peer’s updated network endpoint, but the application, Android, and the new network still determine how quickly service resumes.

Always-on VPN tells Android to keep the selected VPN service active or restart it as needed. It is not a promise that every handoff will be instantaneous or that an unreachable gateway can maintain connectivity.

Captive portals on hotels and public Wi-Fi

Hotels, airports, and cafés often require a browser sign-in before they provide internet access. Block connections without VPN may prevent that local sign-in page from loading because the network has not yet granted ordinary internet access.

A practical sequence is:

1. Join the Wi-Fi network.
2. If the sign-in page does not appear, temporarily turn off Block connections without VPN.
3. Complete the network’s captive-portal sign-in.
4. Connect TuxlerVPN.
5. Re-enable the blocking setting if you want Android to block non-VPN traffic.

Only use a captive portal you recognize as belonging to the venue or network operator. HTTPS remains the primary protection for website content and credentials, including when a VPN is active.

Battery settings and background restrictions

Some manufacturers apply additional battery restrictions to background apps. If the VPN service stops unexpectedly, check Settings > Apps > TuxlerVPN > Battery and review the available background-use options. Allowing unrestricted background use can improve persistence on some devices, but it may also increase battery consumption.

This setting is device-specific. It does not change the encryption protocol or guarantee a particular connection duration.

Which configuration should you use?

Choose the configuration that fits your network and device. If internet access stops, confirm the VPN is connected, temporarily review the blocking setting, and check Android’s Private DNS and battery settings.

TuxlerVPN Mobile uses Android’s VpnService and WireGuard to create an encrypted connection to TuxlerVPN Mobile VPN gateways.