Android VPN Guide: Keep-Alive and Split Tunneling Tested

Picking an Android VPN isn't judged by the same standards as desktop. On a computer you compare routes and protocols; on a phone the tunnel has to clear three extra hurdles: whether the system's battery policy kills it, whether background keep-alive is stable enough, and whether split tunneling can let only the apps you choose out. Get these wrong and even a rock-solid route dies ten minutes after the screen locks. Below we compare common approaches on all three, then give a settings combination for always-on use and an order for choosing a plan.

Background keep-alive: how battery policy kills the tunnel

Android's chain has two more layers than desktop: between the client and VpnService sits the system's power management, and between the system and the node sit local DNS resolution and the network egress. Since Android 6.0 there have been Doze and App Standby, which batch-defer network access and wakeups once the screen is off; manufacturers then stack a more aggressive battery policy on top of Doze. VpnService is managed by the system, but when the process is frozen the tunnel still drops.

The symptoms are easy to spot: the connected icon is still in the notification shade but pages won't load; the first request after a while on the lock screen takes ten-odd seconds; the tunnel doesn't come back on its own after switching from Wi-Fi to mobile data. When that happens, check system settings first and suspect the route second.

The standard client approach is a foreground service with a persistent notification. That line in the shade isn't decoration — it's the system's proof that this process is doing something the user can see, and most customized builds will end the service along with the notification if it's swiped away, so rule one is don't swipe it. Rule two is to take the app off the battery optimization list: on stock Android the path is Settings → Apps → client → Battery → Unrestricted, while customized builds move it into their own battery or phone-manager app and rename it Battery policy, Background power usage or App launch management. The table below covers common customized builds; versions vary, so go by whatever the search box in Settings finds.

One more thing that's easy to miss after all that: system power-saving mode and sleep standby can temporarily override the settings above. When the battery runs low the system tightens background activity on its own, and the tunnel dropping isn't the client's fault. For a device that stays connected all day, set power-saving mode to manual, or just turn it off.

Split tunneling: which apps should use the tunnel

Split tunneling is a system-level capability on Android: VpnService lets an app declare which package names it will carry, and apps that aren't selected go straight out over the local network without touching the tunnel. It's a different layer from routing rules — split tunneling decides which apps enter the tunnel, routing rules decide which destinations get proxied and which go direct once inside. The two stack.

There are two common trade-offs. An allowlist ticks only the apps that need the faster path: browser, streaming clients, the office suite you sign into on an overseas node, with everything else going direct. A blocklist does the reverse — everything through the tunnel by default, with banking, payment and local services excluded. The allowlist saves battery and causes fewer false positives; the blocklist is less work but easily confuses local apps' region detection.

Routing and DNS

Rule mode routes by domain, IP range and GeoIP — local destinations direct, everything else through the proxy — and it's the least fussy setup for always-on use. Global mode pushes all traffic into the tunnel; handy for troubleshooting, but leaving it on day to day slows local services down. DNS is the other easy thing to overlook: if lookups don't go through the tunnel and are handed to the local network or ISP instead, the resolution result won't match the exit region — at best cross-region content checks go wrong, at worst pages simply won't open. Pointing DNS at in-tunnel resolution in the client, or enabling encrypted DNS, avoids this whole class of problem.

One more small trap: if the system's Private DNS is on, it can fight with the DNS settings inside the client. Turn it off while troubleshooting, then add things back one at a time once you've confirmed normal service.

Protocols and routes: trade-offs on mobile networks

The protocol decides how client and server handshake and encrypt; the route decides which path the data takes. Mobile networks are characterized by fluctuating packet loss and frequent cell handovers, so the choices here aren't quite the same as on fixed broadband.

VLESS doesn't encrypt on its own — security comes from the outer TLS or REALITY layer — and its overhead is low, which suits long sessions. VMess is widely compatible but sensitive to device time: if the system clock drifts too far, the handshake fails outright, so when you hit "won't connect but the node is fine", check whether time is set to sync automatically. Trojan runs over standard TLS, so its traffic resembles ordinary HTTPS. Shadowsocks is lightweight and easier on the battery on low-end devices, with weaker obfuscation than the TLS family. Hysteria2 and TUIC are both QUIC-based and run over UDP, with more aggressive congestion control that feels smoother across cell handovers and heavy loss — at the cost of higher battery drain, and some networks restrict UDP, so if you can't connect, switch back to a TCP-based protocol first.

Route type decides how stable things are at peak hours. IEPL dedicated lines run on a private channel and don't crowd the public international egress, so they fluctuate less — good for video calls and long sessions. Relay routes forward through a third location, adding a hop: cheaper, but more jitter at peak. Direct routes are the cheapest and most exposed to local egress congestion. On Android there's an extra practical constraint: cell handovers briefly interrupt the connection, so the advantage of a dedicated line shows up mainly in how fast it recovers and how stable it is after reconnecting.

A settings combination for always-on use

Here's the above condensed into an order you can actually follow, for a phone that stays connected every day:

1. Install the client and import the subscription link. The subscription URL is as good as an account credential — keep it on your own devices and don't paste it into public groups or screenshots.
2. On the first connection the system shows a connection request; tick "Always allow" so you don't have to confirm manually every time you unlock.
3. Using the table above, set battery optimization to Unrestricted, enable autostart and background activity, and lock the client in the task list.
4. For split tunneling choose the allowlist: tick browser, streaming and the overseas office suite; leave banking, payment and local services unticked so they go direct.
5. Set DNS to in-tunnel resolution and turn off the system Private DNS that conflicts with it.
6. Verify: lock the screen for ten minutes, then open the IP lookup page — if the exit region still matches the node you picked, keep-alive is working.

Step five is the one most often skipped. A wrong DNS setting doesn't show up immediately as a failure to connect; it shows up as some sites not opening and some apps saying your region isn't supported, which is the most time-consuming thing to diagnose.

Choosing a plan and data packs by usage

Android usage is harder to estimate than a computer's: background sync, maps and short video all quietly burn data. Working backwards from roughly how much you use per month beats sorting by price. This service's monthly subscription resets data on the same day each month from activation, and upgrading mid-cycle converts the price difference into remaining days; data packs are used until they run out and never expire, which suits people with irregular usage.

There's no cap on device count: one subscription can sign in on phone, tablet and computer at the same time, with no separate charge per device. Payment is via Alipay, WeChat or USDT; signing up needs only a username and password, with no email address required. A full refund can be requested within 7 days of the first payment, so if you're unsure about usage, start with the smallest tier.

Conclusion: configure the system first, then pick a route

• ✅ Battery optimization set to Unrestricted, with autostart and background activity enabled.
• ✅ Split tunneling lets only the apps you need through; payment and local services go direct.
• ✅ DNS resolves inside the tunnel, avoiding the region mix-ups local resolution causes.
• ✅ Recheck the exit region on the IP lookup page after ten minutes on the lock screen.
• ❌ Swiping away the foreground service notification — most systems end the tunnel with it.
• ❌ Running two VPN-type apps at once — the system keeps only one channel.
• ❌ Leaving global mode on all the time — local apps' region detection easily goes wrong.

If you just want a starting point: pick a monthly plan, install the client, work through the six steps above, then spend a week watching how the connection behaves after the screen locks. Once your usage settles, decide whether to move up a tier or switch to a data pack — better than buying the biggest tier on day one.