The key to setting up an Android VPN is getting the client, subscription configuration, and system permissions working together. Installing the app does not mean you are connected, and a VPN icon in the notification bar does not prove that an app is using the intended route. Follow the steps below, then check access, your exit IP, and connectivity after locking the screen to confirm the setup is working.
Before you install: choose a client and check the subscription format
The client is the software that runs the connection. A subscription link provides access to route configurations, and a node is a connection destination you can select from those configurations. Subscription links often contain access credentials, so treat them like passwords. Don’t post a complete link in public forums or submit it to an unfamiliar online converter.
Start at the client download page in the VPNGZ dashboard. Check the Android installation instructions, then choose software according to the current guidance. Clients don’t all use the same configuration format; supporting a particular protocol doesn’t mean a client can read every subscription format. Before copying a link, make sure the dashboard’s import method is compatible with your chosen client.
| Term | What it does | What to check |
|---|---|---|
| Subscription link | Fetches nodes and related configuration from the service | Whether the link is complete and compatible with the client |
| Shadowsocks / VMess / Trojan / VLESS | Proxy protocol or protocol family | Whether the client core supports the protocols and transport options used in the configuration |
| Hysteria2 / TUIC | QUIC-based proxy protocol | Whether the client implementation and network UDP support meet the requirements |
| Rule mode | Routes traffic based on conditions such as domain, address, or app | Rule sources, default policy, and app exclusions |
| VPN / TUN mode | Routes traffic through the system’s virtual network interface | Whether system authorization is complete and which apps are routed |
Install a client: grant only the permissions it needs
- Use a trusted download source. Follow the dashboard’s instructions to find the client’s official release channel, then verify the app name, publisher, and installation instructions. Don’t install an app just because its name resembles one shown in search results.
- Follow the system prompts. If the app is distributed as an installation file, Android may ask you to allow your current browser or file manager to “install unknown apps.” Open Settings and grant permission only to the source you’re using for this installation. You can turn it off once installation is complete.
- Open the app for the first time. Read the startup prompts. A standard network proxy usually doesn’t need access to unrelated data such as your contacts. If a permission doesn’t match the app’s purpose, pause and verify the source. Permission to use the system file picker when importing a local configuration is a separate matter.
- Find the configuration section. It may be called “Configuration,” “Subscription,” “Config file,” or “Profiles.” Open that section first; don’t turn on the connection yet.
If Android says “Can’t install app,” first check available storage, whether the installation file downloaded completely, and whether the app supports your Android version and processor architecture. Don’t repeatedly try by disabling system security checks. On a managed device, installation or VPN permissions may be restricted by policy; follow your organization’s device management requirements.
Import a subscription: update it before choosing a node
Open the subscription or connection configuration page in the dashboard and choose the option for your client. If there’s an “Import to client” option, tapping it should open the installed app. If the only option is to copy a link, return to the client and add it manually. Button locations vary by app version, but the steps are the same.
- In the client’s configuration list, tap “Add” or “+,” then choose “Import from URL,” “Remote configuration,” or a similar option.
- Paste the complete subscription URL into the URL field. Give it a recognizable local name, then save it. Don’t mistake the dashboard webpage address for a subscription URL.
- Tap “Update,” “Refresh,” or “Download configuration,” then wait for the import to finish. Check that node names appear in the list, rather than just a new, empty configuration entry.
- Select the configuration you just imported. Then open the “Proxy,” “Nodes,” or policy group page and choose a route. If there are multiple policy groups, make sure you’ve also selected the group actually used by the site you want to access.
If you see a parsing error, check the format first rather than reinstalling the app. Some clients read configuration files in a specific format, while others read collections of protocol share links; the two aren’t interchangeable. If fetching fails, check your internet connection, whether the link has expired, and whether your device’s date and time are correct.
Updating a subscription and switching nodes are separate actions. Updating fetches the latest configuration from the service; switching changes the route in use. An update may replace nodes or rules. If you haven’t updated in a while, update first, then check whether your previously selected policy is still available.
Grant VPN access: route app traffic through a connection
Return to the client’s home screen and tap “Connect,” “Start,” or the VPN toggle. Android will usually show a system connection request explaining that the app wants to establish a VPN connection. Check the app name before confirming. This permission lets the software create a local virtual network interface; it doesn’t verify the route provider’s privacy policy for you.
Some clients offer both “Proxy only” and “VPN” modes. When only a local proxy port is enabled, apps that haven’t been configured to use it may not send traffic through it. If you want apps to follow the client’s rules, beginners should usually enable VPN or TUN mode as instructed by the client’s official documentation.
If the connection won’t start, open system Settings and search for “VPN” to see if another VPN app is already connected. Ad blockers, firewalls, and other network tools that use Android’s VPN interface may conflict too. Disconnect other VPNs first, then try starting the client again.
Battery settings: prevent disconnects when the screen is locked
If the connection works at first but stops after you lock the screen or switch apps, the system may be restricting the client’s background activity. First check that its connection notification is still present, then adjust the battery settings. Not every disconnect is caused by the route.
Long-press the client icon, open “App info,” and look for “Battery,” “Battery management,” or “App battery usage.” Allow background activity or set battery usage to “Unrestricted,” depending on the options available. Some systems also have a separate “Auto-start management” setting where you can allow the client to start automatically. If the client’s instructions say to keep background tasks running, lock its task card using the method provided by your device.
Notification permission and VPN permission are separate. Allowing connection status notifications can help you monitor background activity, but a notification alone doesn’t prove the network is connected. After making changes, lock the screen, unlock it, and open the app you want to use. Check whether you need to reconnect. Background activity can use more battery, so adjust settings only for clients you actually use.
When you switch from Wi-Fi to mobile data, the existing connection may need to be re-established. If it fails only after switching networks, stop and restart the connection, then check whether it recovers. Treat this separately from battery-related background cleanup.
Verify the connection: check your exit IP, routing rules, and DNS
Check the traffic you want to route, not just the color of the connection toggle. In rule mode, sites in mainland China or excluded apps may still connect directly—that’s how split tunneling is meant to work. Choose a destination you actually need to access, then compare what happens before and after connecting.
- ✅ Check your internet connection. Disconnect the client and make sure regular websites load. If your internet connection isn’t working, fix that first or complete any required network sign-in.
- ✅ Check access to your destination. Connect, open the site you want to use, and navigate to the feature you need. Loading the homepage doesn’t prove that login, image, or video requests are following the right rules.
- ✅ Check for an exit IP change. Use a trusted IP lookup page to see where the address is registered. The test page may also be routed by your rules, so check the client’s connection logs too. Don’t draw conclusions from the displayed region alone.
- ✅ Check app routing. In the client, open “App proxy,” “Bypass apps,” or a similar setting and make sure the app you want to use isn’t excluded. Check this setting in particular if your browser works but another app doesn’t.
- ✅ Check DNS routing. Review the DNS settings according to the client’s instructions and use a trusted test page as a supplementary check. A webpage loading successfully doesn’t prove that DNS queries are taking the expected route.
- ✅ Test after locking the screen and switching networks. Repeat the actions you normally take and confirm you can still access the service after returning to the app or changing networks—not just immediately after setup.
A DNS leak generally means that DNS queries are going outside the expected tunnel or resolution policy. If a test page shows a resolver in a different region from your exit IP, that alone doesn’t prove there’s a leak. Public DNS infrastructure, caching, and geolocation databases can all affect the result. Check the configured resolver, domain routing rules, and client logs together.
Android Private DNS, encrypted DNS in your browser, and the client’s own DNS settings may all be active at once. Encrypted DNS protects queries in transit, but doesn’t guarantee that they use the proxy. If results look unexpected, note the original settings and adjust them one at a time according to the client’s documentation. Changing everything at once makes the cause harder to find. If the client supports IPv6, also check how it handles IPv6 traffic.
Common issues: narrow down the cause by symptom
The node shows a latency result, but websites won’t load
A latency test may check only one address or a handshake; it doesn’t prove that all app traffic is working. First confirm that you selected the right configuration and policy group, then check DNS, system time, and the client’s connection logs. DNS resolution failures, handshake errors, and connection timeouts point to different stages. If you contact support, you can include a redacted excerpt of the error.
The browser works, but an app doesn’t
First check whether the app is excluded and whether its domains match the right rules. If the client supports it, temporarily switch to global mode for comparison. If global mode works but rule mode doesn’t, investigate the rules rather than relying on repeated node changes. Global mode can’t override a platform’s own account, regional, or content licensing requirements.
The app still doesn’t work after switching to a dedicated route
Direct, relay, and IEPL routes describe network paths or transport methods. They don’t determine the subscription format or replace Android permission settings. A dedicated route’s name doesn’t prove that DNS is configured correctly or guarantee that a third-party platform will accept its exit IP. Compare options in the route list, and verify the configuration on your device separately.
What to prepare before contacting support
Note the client name and version, Android version, network type, the action that triggers the issue, and any error message. Then send the details through a support ticket in the dashboard. Redact your username, subscription URL, and credentials in screenshots; don’t upload the complete configuration file. This preserves useful diagnostic details while avoiding unnecessary exposure of your information.