Set up VPN on Android devices (2024)

This article helps IT admins configure virtual private networks (VPNs) on Android devices. Some older versions of Android don't support all the features mentioned here. To check your Android version, see .

Android VPN options

VPNs allow devices that aren’t physically on a network to securely access the network.

Android includes a built-in (PPTP, L2TP/IPSec, and IPSec) VPN client. Devices running Android 4.0 and later also support VPN apps. You might need a VPN app (instead of built-in VPN) for the following reasons:

  • To configure the VPN using an enterprise mobility management (EMM) console.

  • To offer VPN protocols that the built-in client doesn’t support.

  • To help people connect to a VPN service without complex configuration.

  • To run a separate VPN for the personal profile or work profile.

To get help with the built-in client, see Connect to a virtual private network (VPN) on Android.

EMM config

You can configure many VPNs using an EMM console—confirm that your VPN and EMM combination supports this. Using an EMM means that the people using the devices don’t have to change complex settings. EMMs often support the following config:

Always-on VPN

Android can start a VPN service when the device boots, and keep it running while the device or work profile is on. This feature is called always-on VPN and is available in Android 7.0or higher. To learn more, see Edit Always-on VPN settings.

Block non-VPN connections

In many EMM consoles (and in the Android Settings app), you can block connections that don’t go through the VPN. To force all network traffic through an always-on VPN, follow these steps on the device:

  1. Open your device's Settings app.

  2. Tap Network & internet Set up VPN on Android devices (1) Advanced Set up VPN on Android devices (2) VPN.

  3. Next to the VPN that you want to change, tapSet up VPN on Android devices (3) Settings.

  4. Switch Block connections without VPN to on.

To block non-VPN connections in your EMM console, see your EMM provider’s documentation.

Allow bypassing the VPN

If your VPN supports it, you can allow apps to bypass the VPN and select their own network. Some special-purpose apps might need to use a specific network, such as cellular or Wi-Fi. You can configure this option in your EMM console or directly in the VPN app.

Per-app VPN

Many VPN apps can filter which installed apps are allowed to send traffic through the VPN connection. You can create either an allowed list, or, a disallowed list, but not both. If you don’t create a list, the system sends all network traffic through the VPN.

You normally configure per-app VPN in your EMM console or directly in the VPN app.

Allowed apps

You can choose which apps are allowed to use the VPN using an allowed list. If you allow one or more apps, then only the apps in the list use the VPN. All other apps (that aren’t in the list) use the system networks as if the VPN isn’t running.

When you also turn on Block connections without VPN, then only apps in the allowed list have network access.

Disallowed apps

You can select which apps you don’t want to use the VPN by creating a disallowed list. Network traffic of disallowed apps uses system networking as if the VPN wasn’t running—all other apps use the VPN.

When you also turn on Block connections without VPN, then these disallowed apps lose network access.

Google Play traffic

You might want to explicitly include or exclude Google Play traffic from your VPN if traffic is metered. Here are the Google Play app packages that you’d need to allow or disallow:





Restrict system settings

If your EMM supports it, you can prevent device users from changing system VPN settings. In some versions of Android, this restriction stops an always-on VPN from starting:

Android version


Behavior when restricted


Fully managed devices

VPN app doesn’t start.


Fully managed devices and work profile

VPN app doesn’t start.

7.0 or higher

Fully managed devices and work profile

Always-on VPN app starts if set by device policy controller. Other VPN apps don’t start.

Related articles and guides

Was this helpful?

How can we improve it?

Need more help?

Try these next steps:

Post to the help community Get answers from community members
Set up VPN on Android devices (2024)
Top Articles
Latest Posts
Article information

Author: Reed Wilderman

Last Updated:

Views: 6282

Rating: 4.1 / 5 (72 voted)

Reviews: 87% of readers found this page helpful

Author information

Name: Reed Wilderman

Birthday: 1992-06-14

Address: 998 Estell Village, Lake Oscarberg, SD 48713-6877

Phone: +21813267449721

Job: Technology Engineer

Hobby: Swimming, Do it yourself, Beekeeping, Lapidary, Cosplaying, Hiking, Graffiti

Introduction: My name is Reed Wilderman, I am a faithful, bright, lucky, adventurous, lively, rich, vast person who loves writing and wants to share my knowledge and understanding with you.