A proper Android VPN setup is about more than seeing “Connected.” Your subscription, system permissions, routing rules, and background operation all need to work together. This guide follows the setup process in order and explains what to expect at each step. Settings names vary by device brand; if yours differ, search for the relevant term in Settings.
Before you install: accounts, subscriptions, and clients
Your account gets you into the service dashboard. A subscription link provides route configurations, and a client reads those configurations to establish a connection. These serve different purposes. Pasting the dashboard login URL into a subscription field, or using your account password as a route password, usually won’t import anything.
S4VPN doesn’t require an email address; create an account with a username and password. If you already have an account, sign in to the user dashboard to check your plan, data usage, and service status, then get your subscription from the dashboard. The dashboard shows whether your account is eligible for a subscription; don’t assume it is just because you created an account.
Install a client: check its source and compatibility first
Open the client download page in the dashboard and follow the Android instructions. This guide doesn’t claim that any one client supports every route, and it doesn’t link directly to installation packages. Follow the dashboard’s current guidance on client names, download sources, and compatible configurations.
If you download an installation package, Android may ask you to allow the current browser or file manager to “install unknown apps.” Verify the source, then grant only the permission needed for this installation; you can revoke it afterward. If Android displays a security warning, check the source and version requirements first. Don’t disable system-wide protections just to proceed.
“Add VPN” in Android Settings isn’t a general-purpose subscription importer. Services that support native system configurations use a different setup process from clients that use proxy subscriptions. If the dashboard provides a subscription link, import it in the appropriate client first. Don’t paste it into the system’s server field at random.
Import a subscription: load your route list
The client may call this section “Configuration,” “Subscription,” “Profiles,” or “Import from URL.” Open the relevant page and use the format provided by the dashboard. A QR code is just another way to transfer a configuration; it won’t resolve incompatibilities between the client and subscription format.
- Copy the subscription link from the dashboard. Make sure it contains no extra instructions, spaces, or line breaks.
- Open the subscription or configuration manager in the client and choose the option to import from a link. If the dashboard offers an option to open the link in the client, you can follow its prompts instead.
- Save the configuration and update it. Check that routes or proxy groups appear, rather than just an empty profile name.
- Enable the imported configuration and select an available route on the route selection screen. Make sure the client isn’t still using an older configuration.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different proxy protocols or implementations. Client support depends on its core and version. A file being saved doesn’t mean every protocol in it will work. If you see an “unsupported type” or configuration parsing error, check the compatible format instead of repeatedly switching routes.
A subscription update error occurs while the client is fetching configuration. It’s separate from whether a particular route can connect. First check whether your device can reach the dashboard, whether the link is complete, and whether the subscription is still valid. Then review the client’s error message. Don’t upload credentials to unfamiliar tools for testing.
Grant VPN access and check which traffic it covers
The first time you connect, Android usually displays a system prompt to confirm the VPN connection. Check the requesting app’s name before allowing it. This permission lets the client route relevant traffic through Android’s VPN interface; it doesn’t grant the app other system permissions.
If another app is already using Android’s VPN interface—for example, a local filtering tool, a work network client, or another proxy client—it usually can’t share that interface in the same user account or profile. If the connection drops as soon as it starts, stop the conflicting app and try again. Work-profile behavior may also be restricted by your organization’s policies.
Check the connection mode, too. Rule mode uses domain, address, or app rules to decide whether traffic goes through the proxy or connects directly. Global mode generally sends traffic covered by the client through the selected proxy, but apps outside its scope may still connect directly. If “proxy selected apps only” is enabled, make sure both your browser and the target app are included.
Battery optimization: prevent disconnects when the screen is locked
If the connection works in the foreground but fails after you lock the screen, battery optimization or the manufacturer’s background management may be stopping the client. Open the app’s system settings and look for battery, background activity, or power management options. Allow background activity or choose an unrestricted setting. The exact names vary by device.
Some devices also offer auto-start controls and an option to lock an app in recent tasks. Follow the client and system guidance when using these, but they can’t guarantee the process will always stay active. System updates, low battery, and memory pressure can still affect it. Locking the app in recent tasks is not a substitute for Android’s VPN service.
- ✅ The client is allowed to run in the background and isn’t restricted by battery saver.
- ✅ If the client needs a persistent notification, notifications are enabled so you can check its status.
- ✅ The app’s background data access has been checked when Data Saver is on.
- ✅ After locking the screen, reopen the target app and confirm the connection still works. Don’t rely on the client’s toggle alone.
- ✅ Switch between Wi-Fi and mobile data, then check whether the client reconnects.
If the connection is briefly unavailable only after switching networks, give the client a moment to recover before reconnecting. If it disconnects every time you lock the screen, check background restrictions first. If the issue occurs only on a particular network, check its sign-in requirements, access restrictions, and compatibility with the route.
Verify the connection: check the exit route, routing rules, and DNS separately
The VPN icon in Android’s status bar only confirms that the interface is active; it doesn’t prove that a particular app is using the intended route. First check whether your browser is covered by the proxy rules, then open the IP lookup page and compare the exit details before and after connecting. The exit location depends on the route you use, not the client’s display language.
In rule mode, the IP lookup page may be classified as direct traffic, so an unchanged exit IP alone doesn’t prove the connection failed. Check the client’s connection logs to see which rule matched the request and whether it used a direct connection or proxy. Then test the app you actually need to use.
| Check | How to check | What this does not prove |
|---|---|---|
| System connection | Check the VPN status in Android and the connection status in the client. | It doesn’t prove that the target website is reachable. |
| Exit address | Check the exit address and the routing rule matched by the request. | A browser’s results don’t show how other apps are routed. |
| Domain resolution | Check a DNS test against the client’s DNS configuration. | The resolver’s location may not match the actual exit location. |
| Background operation | Check again after locking the screen, resuming use, and switching networks. | A working foreground connection doesn’t mean background activity is unrestricted. |
A DNS leak occurs when DNS requests bypass the intended protection path. Android Private DNS, a browser’s Secure DNS, and the client’s own DNS settings can each affect how names are resolved. An unfamiliar resolver name in a test doesn’t automatically mean there’s a leak; public DNS services may use a remote exit or label addresses differently.
A safer approach is to keep the client’s recommended settings initially, then check whether its DNS requests use the intended proxy or channel. If settings conflict, change one at a time and test again. Changing Android DNS, browser DNS, and client rules all at once makes the cause difficult to identify. Don’t leave existing secure DNS settings disabled just to make a test page display consistent results.
Common issues: troubleshoot where the problem occurs
Routes appear, but the connection times out
First make sure the device can access the internet on its current network. Hotel and public Wi-Fi may require you to complete a sign-in page. Then try another route and check whether the error occurs during DNS resolution, the handshake, or after the connection is established. A location in a route name doesn’t guarantee quality. IEPL, transit, and direct describe transport paths, not client protocols; changing a protocol label can’t turn a direct connection into a dedicated line.
The browser works, but one app doesn’t
Check whether the app is excluded from VPN routing and whether its domain matches a direct-connection rule. Also consider the app’s cache, account region, device permissions, and service restrictions. A change in network exit doesn’t change third-party account eligibility or guarantee access to every platform feature.
All apps lose internet access after connecting
Stop the client first and check whether the regular network connection comes back. If it doesn’t, check whether Android is set to block connections without a VPN. Once the regular connection works, review the selected configuration, route, DNS, and rules. Don’t keep adding other network tools; doing so can create more routing and interface conflicts.
What to include when asking for help
Note your device’s operating system, client name and version, network type, error message, and steps to reproduce the issue. Then submit them through the support ticket page. Hide subscription credentials and sensitive account details in screenshots. If needed, consult the setup guide to check the dashboard’s current configuration instructions.
What “done” looks like: The configuration updates successfully, Android VPN access is granted, target apps follow the expected routing rules, and the exit and DNS paths have been checked. The connection also recovers after you lock the screen or switch networks. Once these checks pass, keep the current configuration; don’t stop at a “Connected” message.