Always-on VPN on Android is not the same as tapping Connect in the app. It is a system setting: this VPN app should stay up, and optionally nothing else should leave the phone if the tunnel is down. That second part is the lockdown-ish switch Google labels Block connections without VPN. People turn both on because a blog said to, then they cannot log into hotel Wi-Fi, their banking app sulks, and the battery graph looks like a cliff. They uninstall. They tell a friend VPNs drain phones. The friend believes them.
This is not a clone of our Android setup guide. That guide is download, sign in, first connect. This one assumes the app already works. It is about when to leave Always-on on, when to use the stricter block, and when to leave both off so a teenager can still join school Wi-Fi.
Android implements consumer VPNs through VpnService. That API is how a normal app asks the OS to take the device's traffic, wrap it, and send it to a server. Always-on is policy on top of that service. If you want the primary source, read Google's VpnService reference. I will translate it into household decisions.
KloxVPN on a phone is WireGuard when the network is normal, OpenVPN when the network is rude, five devices on the plan, yearly from $2.83 a month, seven-day money-back if the household hates the seating chart. Always-on on five phones can hold five slots overnight. That is the part families miss. A tablet that 'isn't even being used' can still own a seat.
I am opinionated here. I want Always-on on a travel phone. I want the full block on a phone that does journalism or a lot of cafe work and whose owner knows how to turn it off for a captive portal. I do not want both on every kid device in the house. That is how dinner becomes a support queue.
Related reading: VPN on Android: Privacy and Permissions and How to Set Up a VPN on Android: Step-by-Step Guide. Why You Need a VPN Kill Switch and Family VPN on Five Devices. What is a VPN? and Download KloxVPN.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
Always-on is not auto-connect
In-app auto-connect means the client tries to start a tunnel when you join Wi-Fi or when the app wakes. Useful. Incomplete. Android can still kill the app, ignore it after a reboot until someone opens it, or let a few packets out before the tunnel is up.
Always-on VPN is a system checkbox: this app is the device VPN and the OS should keep it started. After reboot, the OS brings it back without waiting for you to hunt an icon. That is the feature people actually wanted when they said 'just keep it on.'
A VPN is still just a tunnel. Always-on does not make the tunnel smarter. It makes forgetting harder. Forgetting is how cafe Wi-Fi gets a clear look at your traffic. HTTPS still encrypts many sites. DNS, SNI, and the fact that you associated with that SSID still leak without a tunnel. I care about that on travel phones. I care less on a home tablet that never leaves the apartment.
- 1Download the app from klox.app/download — not a random APK site.
- 2Sign in with the account you paid for.
- 3Press WireGuard. Wait for the connected state.
- 4If it fails, try OpenVPN. Still failing: note the network (hotel, campus, home) before you write support.
First successful connect
| Mode | If the tunnel drops | Hotel / airport portal | Battery mood |
|---|---|---|---|
| Manual connect only | Traffic can go clear until you notice | Usually fine | Lowest extra cost |
| In-app auto-connect | Short leak window possible | Usually fine | Low to medium |
| Always-on, block off | OS restarts VPN; brief gaps possible | Usually fine | Medium |
| Always-on + Block connections | Traffic blocked until tunnel is back | Often broken until you disable | Medium; frustration higher |
Turn on Block connections only if you know where the toggle lives when the lobby page will not load.
— KloxVPN household notes
Cloudflare Learning: What is a VPN?
Where the toggles hide
Stock Android: Network & internet, then VPN, then the gear next to the app, then Always-on VPN, then Block connections without VPN. Samsung and Xiaomi move this. Search the settings app for always-on. If you cannot find it, you will not find it in a hotel lobby at 11 p.m. Screenshot it at home.
One VPN at a time
Android allows one device-wide VPN. Always-on commits that slot. A work profile VPN, a second consumer app, or a 'secure browser' that also wants VpnService will fight you. Pick one. Households that install three VPN apps 'just in case' will have a bad night.
What VpnService is doing on the phone
VpnService lets an app create a virtual network interface, grab traffic, and ship it to a remote peer. The first connect shows a system dialog. That dialog is not Klox being dramatic. It is Android telling you an app is about to see device traffic. Approve it or the tunnel never exists.
Always-on tells ConnectivityService to keep that VpnService bound. Block connections tells the OS to drop non-VPN traffic while that policy is on. Google documents this in the VpnService API, including lockdown-style behavior. I am not going to retype the class reference. I am going to say: the OS is the kill switch when Block is on. The app kill switch is a second opinion. They can overlap. They can also disagree if the app thinks it is connected and the OS thinks it is not.
Encryption inside the tunnel is the protocol's job. WireGuard is the default I want on a phone. OpenVPN is what I try when a network is hostile. TLS documents like RFC 8446 are the boring background for 'yes, modern crypto exists.' They do not turn Always-on on for you.
The consent dialog comes back
After an app update, a clear-data, or some OEM bugs, Android may ask again. If Always-on is on and you deny the dialog, you can lock yourself out of the internet when Block is also on. That is the trap. Teach the household: if the phone has no internet, look at VPN permission before you factory reset.
Split tunneling versus Always-on
If the app excludes some apps from the tunnel, Always-on still runs. Block connections can still allow those exclusions or not, depending on the client and OS version. Do not assume. Test the banking app and the hotel portal on your build.
Block connections without VPN: the lock
This is the lockdown-ish mode. If the tunnel is down, the phone should not chat on the clear path. That is what people mean when they say kill switch on Android and actually get it.
The cost is captive portals. Hotel, airport, and some school networks require a browser page on the local network before they route you. If the OS blocks all non-VPN traffic, that page never loads. You sit in the lobby with a full signal and no internet. The fix is: disable Block (sometimes Always-on too), complete the portal, reconnect. If you cannot find the toggle, you are stuck. That is why I will not put Block on a device whose owner cannot navigate Settings.
Some phones offer a 'allow bypass for captive portals' behavior. Do not trust it on every OEM. Test at a cafe before you need it at an airport.
When I want the lock
Travel phone. Journalist phone. Anyone who will use random SSIDs and who understands the lobby dance. Cafe workers who have been burned once. Not a shared family tablet that grandma uses for recipes.
When the lock is theater
If you turn Block on and then disable battery exemption so Android kills the VPN app every night, you get a phone that cannot load anything until morning. That is not privacy. That is a brick with a SIM. Unrestricted battery for the VPN app is part of the lock, not an optional extra.
Battery, Doze, and OEM killers
Always-on keeps a process and a tunnel. That costs some battery. On a modern phone with WireGuard, it is usually a dull line on the graph, not a cliff. Cliffs happen when the OEM's 'battery saver' kills the VPN every twenty minutes, the OS restarts it, the handshake storms, radios wake, and you repeat until 11% at lunch.
Fix: app battery set to Unrestricted. Disable adaptive kill for that app. On Xiaomi, Samsung, Huawei, look for autostart and 'sleeping apps.' This is the real Android VPN skill. Protocol choice is second.
If the graph is still ugly, check whether you are bouncing between Wi-Fi and mobile every few seconds in a building with bad coverage. Always-on will reconnect each time. That is physics. Move, or accept the cost, or drop Always-on in that building.
WireGuard versus OpenVPN on a phone that never sleeps
WireGuard is lighter on a stable network. OpenVPN can survive rude networks better and may cost more CPU. If Always-on plus OpenVPN plus a weak hotel Wi-Fi is cooking the phone, switch protocol first, then consider dropping Always-on for the night. Do not start with 'VPNs just drain battery' as a personality.
Screen off is not disconnected
A 'sleeping' phone with Always-on is still a connected device on the plan. Families treat screen-off as off. The network does not. That tablet on the couch is a seat.
Captive portals: hotels, airports, schools
The failure mode is always the same. Phone associates with the SSID. Portal wants a local HTTP page. VPN policy will not let that page through. User blames the VPN brand. The brand is doing what they asked.
Practice at home: turn Block on, join a guest network if you have one, see what breaks. Write the steps on a note in the phone. Include screenshots of the Samsung path if that is the phone. School-issued Android devices may forbid Always-on entirely. Do not fight the MDM. You will lose and look suspicious.
Airports sometimes chain a portal and a second paywall. Complete both before you re-enable Block. I have watched people enable Block after the first page and then wonder why the paid hour never starts.
Use mobile data for the portal dance if you must
If Wi-Fi is hostage to a portal and you cannot find the toggle, switch to mobile data, disable Block, finish Wi-Fi login, then put the lock back. Clumsy. Beats a brick in a foreign terminal.
Enterprise portals
Some offices require a client certificate or a separate work VPN. Always-on consumer VPN will fight that. This is when you leave Always-on off on the work phone and use the app manually after you are on the office network, or you use a work profile. Do not stack two device VPNs and hope.
Five-device households and Always-on phones
Klox consumer is five concurrent devices. Always-on on every phone and tablet means five seats filled even when nobody is 'using' the internet. The sixth person — usually the laptop at homework time — gets an error. The error is not 'VPN is down.' The error is 'we overbooked the car.'
Pick who gets Always-on. Travel phones first. The home tablet that never leaves can stay manual. The TV should not steal a seat for Always-on even if the Android TV UI offers something that looks similar. Router VPN is a different article. Here: phones that leave the house get the OS lock. Furniture does not.
When you replace a phone, remove it from the portal. Always-on on a traded-in device you forgot to wipe is how a stranger holds a seat. Factory reset helps. Portal remove helps more.
Kids
A child who cannot complete a captive portal should not have Block connections on. Always-on without Block is a milder default: the tunnel comes back, but they can still load a school login page. You give up some leak protection. You keep dinner.
Shared logins
Do not share the account to 'make six.' Always-on makes shared logins worse because the extra device never drops. Five is the product. Live inside it or buy a second account. I rarely recommend the second account. I recommend a seating chart.
When to leave Always-on off
Home-only tablet. Device that must use a work VPN some days. Phone whose OEM cannot stop killing the app (fix OEM first; if you cannot, Always-on becomes a reconnect storm). Anyone who uses tethering in ways that confuse the OEM. Anyone who cannot find Settings.
Manual connect plus a habit still beats a lock the owner will disable forever after one hotel. I would rather a traveler who connects on SSIDs they do not trust than a traveler who turned everything off in Frankfurt and never turned it back on.
Banking apps and attestation drama
Some banks dislike VPNs. Always-on means you cannot 'just turn it off for a minute' unless you know the toggle. If you bank on that phone, practice the off path. Or bank on a device without Always-on. I will not tell you to break a bank's rules. I will tell you to pick a phone role.
Gaming and latency
A mobile game that hates extra hops will hate Always-on. Split tunnel if the app offers it. Or leave Always-on off on the gamer phone. Privacy is a trade. Pretending it is not is how you get the app uninstalled.
App kill switch versus OS block
The in-app kill switch tries to stop leaks when the process thinks the tunnel died. The OS Block connections policy stops traffic when Android thinks there is no VPN. Use both on a high-risk travel phone if they do not fight. If they fight — connected in the app, dead in the browser — turn one off and test. I trust the OS block more for 'nothing leaves,' and I trust the app more for 'reconnect to a better city.' They solve different minutes of the day.
Our kill-switch article is the concept. This page is the Android switch placement. Do not skip the battery exemption or both switches become a brick.
IPv6 and leaks
A sloppy client can leak IPv6 while looking connected. Always-on does not automatically fix that. If you care, test with a leak tool on mobile data and on Wi-Fi. Wikipedia's VPN page is a decent overview of what a VPN is not. It will not test your phone. You have to.
Notifications that lie
Some OEMs show a key icon whenever a VPN is up. Some hide it. Do not use the icon as the only truth. Open the app. If Always-on is on and the app says disconnected, fix that before you trust Block.
Troubleshooting: sleep, Doze, connected but nothing loads
Sleep disconnect: battery restriction. Allow unrestricted. Doze: same, plus ignore 'optimize.' Connected but nothing loads: DNS fight, captive portal, or Block on with a half-dead tunnel. Disable Block, reload, try OpenVPN, try another city, try mobile data. If a hotel DNS lies, the portal dance is the fix, not a fifth city.
After an Android major version bump, test Always-on the same day. OEMs break VPN in updates. Reinstalling the app is allowed. Clearing data will demand the permission dialog again. If Block is on and you clear data, do it on Wi-Fi you already own, not in a boarding line.
Private DNS versus VPN DNS
Android Private DNS (DoT) can argue with the VPN's DNS. If names fail only with Always-on, try turning Private DNS off or to automatic and test again. This is a settings pile, not a moral issue.
Dual SIM and Wi-Fi calling
Some radios do ugly things with VPN plus Wi-Fi calling plus Always-on. If calls drop, test with Always-on off. Voice is allowed to win. Put the lock on a second device if you must have both.
A household rule of thumb
Travel phones: Always-on on. Block on if the owner can disable it for portals. Home tablets: manual or Always-on without Block. Kids: Always-on without Block, or nothing if the school MDM forbids it. Count seats before you enable five Always-on devices. Leave a spare seat for a laptop that actually works.
Download the app from our download page, not a random APK site. Price is on the pricing page: from $2.83 a month on yearly, five devices, seven-day money-back. Always-on will not change the price. It will change whether the tablet on the couch is still occupying a slot at homework time.
If you came here from a setup tutorial, go back and finish install first. Then come back and decide the lock. Doing it in the other order is how people approve VpnService, enable Block, and then cannot fetch the Play Store to update the app on a portal network. Order of operations is the whole game.
Practice once
This weekend: enable Always-on, join a cafe, disable Block, complete nothing because you do not need a portal, re-enable Block. Muscle memory. Hotels are a bad classroom.
What I will not promise
That Always-on makes you anonymous. That it replaces a password manager. That it stops an app you already granted contacts. A tunnel wraps the path. The OS lock wraps the forgetfulness. The rest of privacy is still your job.
Work profiles, second users, and 'I have two Androids in one phone'
A work profile can run a different VPN than the personal side, or it can forbid yours. Always-on on the personal profile does not always cover work apps. If your job issued the phone, ask IT before you fight the MDM. Fighting the MDM is how you get a device wipe and a conversation with HR.
On a personal phone with a second user (shared tablet), Always-on may apply per user. Test with the kid's user. If the lock is only on the adult user, the kid's session is a different story. Shared tablets are why I like Always-on without Block for furniture.
Guest mode
Guest sessions can drop VPN policy. If you hand a phone to someone at a party, assume the tunnel is gone. Always-on is not a babysitter.
Play updates that reset the gear
Some OEM + Play combinations drop Always-on after an app update until you open the app once. If you rely on the lock, check after updates. A travel day is a bad day to discover the checkbox went cold.
What success looks like after a week
The travel phone still has Always-on in the morning. Battery is dull, not a cliff. Hotel portal: you disabled Block, logged in, turned Block back on, in under two minutes. Nobody in the house asked why the laptop could not connect because four tablets were sitting on seats overnight.
If that week was chaos, the feature is not the problem. The seating chart or the OEM killer is. Fix those before you write off Always-on as 'too heavy.' It is heavy when misapplied. It is quiet when the phone is allowed to keep a WireGuard session and the household knows five means five.
Revisit after a trip
One international trip teaches more than a settings article. Note which airport portal broke Block. Note whether OpenVPN saved you. Change the household rule when you get home, not in the terminal.
Privacy page versus Always-on
Always-on does not change what Klox keeps on the account. Device list and billing still exist. Read the privacy page if you care what the account side stores. The OS lock is local policy on the phone. Do not confuse the two.
Key Takeaways
Always-on VPN on Android is the OS keeping VpnService alive. Block connections without VPN is the lock that drops cleartext when the tunnel dies. Use the first on phones that leave the house. Use the second only if you can find the toggle in a lobby. Watch battery killers on OEM skins. Count five seats, because a sleeping tablet still sits down.
This is not a first-install tutorial. Install, grant the VPN dialog, then decide the lock. WireGuard for normal networks, OpenVPN when the network is rude. If the household hates the seating chart, the seven-day window exists for a reason.
Get the app from the download page. Read current prices on the pricing page. Put Always-on on the travel phone this week, not during boarding.
Related Resources
Put Always-on on the phone that actually leaves the house
KloxVPN: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, from $2.83/month on yearly, seven-day money-back. Download the Android app, then decide Always-on and Block connections on purpose.
Download KloxVPNFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.