Clash for Android: VPN permission, battery optimization and background activity

First connection: grant VpnService access and check your subscription

Clash clients on Android typically use the system VpnService to create a virtual network interface and route eligible traffic through the core. Clients using the mihomo core need this permission too. It is separate from subscription account authorization and is not granted automatically when you import a YAML config.

The button label varies by client: it may say “Start,” “Connect” or “VPN.” Follow the steps by function; client interfaces and manufacturer menus differ. If you can't find the same option, search Settings for “VPN,” “Battery optimization” or “Autostart.”

1. Import a subscription or local config and set it as the active profile. Make sure it parses correctly and that at least one selectable node is available in the proxy groups.
2. Select Rule mode, then choose a reachable node. A successful latency check only means the test target responded; it doesn't guarantee that every app can connect.
3. Tap Connect. The first time, Android displays a system dialog such as “Connection request.” Check the app name, then allow the request.
4. Return to the client and check the connection status and logs. Then open a test webpage and see whether a new connection appears in the connection history.

No permission prompt, or VPN disconnects right after startup

• Another VPN is active: Android usually allows only one active VPN per user or profile. Accelerators, firewalls and some ad blockers may also use VpnService. Disconnect them before trying again.
• Another app is set to always-on: Open Settings → Network & internet → VPN and check the existing VPN settings. On some devices, the option is under “Connection & sharing.”
• Work profile or device policy restrictions: An organization’s management policy may block VPN connections. Contact your device administrator instead of repeatedly reinstalling the client.
• You can't tap the permission prompt: Temporarily disable screen overlays such as floating windows or screen filters, then request permission again from the client. Don't use auto-clickers to bypass the confirmation.

On Android 13 and later, notification permission and VPN permission are separate. Notifications make it easier to check status and disconnect, but they do not grant VpnService access. Denying notifications alone also doesn't tell you whether the service has stopped.

System VPN, TUN mode and rule mode: what’s the difference?

Seeing “VPN” in Android doesn't mean every connection goes through a remote proxy server. Android’s virtual interface receives the traffic; Clash or mihomo rules and proxy groups decide what happens next. A connection matching DIRECT can be handled by the client and then sent directly.

Some Android clients manage the VPN interface and routes themselves, so desktop tun: settings may not apply. Don't add desktop TUN fields to a subscription just to get a VPN icon, and don't assume desktop admin steps work on a phone. Use the Android client’s supported setup instead.

When VpnService is running on your phone, you usually don't need to set a manual proxy for Wi-Fi. If you previously entered a computer proxy, such as 192.168.1.10:7890, set that Wi-Fi network’s proxy to “None” before testing so requests don't depend on a computer that may be switched off.

Battery optimization: remove restrictions, then check autostart

Disconnects after locking the screen are often caused by background restrictions, system sleep or manufacturer cleanup policies, but network changes or node issues can also be responsible. When the connection drops, first check whether the client is still running. If its service notification disappears or the connection toggle resets, check process restrictions. If the service is still running but requests time out, investigate the network and logs.

General Android settings

1. Long-press the client icon and open App info.
2. Open Battery or App battery usage, then select Unrestricted or turn off battery optimization for the app. Available options vary by Android version.
3. Under Mobile data & Wi-Fi or Data usage, allow background data. If Data Saver is on, allow unrestricted data usage if needed.
4. Return to the client, start the connection and test again with the screen locked. Simply switching to the home screen doesn't test background activity.

Where to look on common Android brands

These are common paths, but names vary by system version. Native HarmonyOS apps and apps running in the Android compatibility environment are not the same; check that your system can run the Android client you plan to install.

Exempting an app from battery optimization can reduce background restrictions, but it doesn't guarantee that the app will start on boot. Startup also depends on client support, system autostart permissions and whether the device has been unlocked. Restart to verify the behavior instead of relying on a checked toggle.

Per-app proxying: check whether the list includes or excludes apps

Per-app proxying is useful when you want only selected apps, such as a browser or messaging app, to use the VPN, or want local device-management apps to bypass it. Look under Settings → Network → Per-app proxy or App access control. Labels vary, so focus on what the list means.

• Proxy only selected apps: Selected apps use the VPN; all others are excluded. Check the list when you add an app.
• Bypass selected apps: Selected apps stay outside the VPN; other eligible apps use it.
• DIRECT in rules: An app may still enter the VPN tunnel, then be routed directly by the core. This is different from excluding it at the system level.

For example, to proxy only your browser, select “Proxy only selected apps,” choose the browser you actually use, save, then reconnect the VPN. Some clients reconnect automatically after you change the app list. If yours doesn't, stop and start the connection so the updated interface settings take effect.

Cloned apps, work-profile apps and apps in your personal profile may run under different user identities. The same icon doesn't mean they're all covered. Downloads may also be handled by a system download service, so selecting a browser doesn't guarantee that every external download component uses the same network path.

To test, open a new page in a selected app and check the client’s connection history. Existing long-lived connections and cached results aren't reliable indicators that a rule is working. If no connection appears, check the app list, list mode and active user profile before changing DNS.

Always-on VPN: configure reconnect and lockdown separately

Android 7.0 and later offer the system-level Always-on VPN option, but whether it's available depends on client support and device policies. On near-stock Android, go to Settings → Network & internet → VPN and tap the gear next to the client. On other devices, search Settings for “VPN.”

This screen may show both “Always-on VPN” and “Block connections without VPN.” The first asks the system to keep the VPN running or restart it; the second blocks network access outside the VPN. Neither checks whether your node works or fixes a malformed config.

1. First, make sure your subscription, nodes, DNS and per-app settings work in normal connection mode.
2. Turn on Always-on VPN. Test what happens after a restart, after unlocking and after manually disconnecting.
3. Enable “Block connections without VPN” only if you need to prevent traffic from bypassing the VPN.
4. Test the browser, excluded apps, local network devices and Wi-Fi networks that require a sign-in page.

Hotel and airport Wi-Fi often requires portal sign-in. If the VPN and lockdown setting prevent the login page from opening, temporarily turn off blocking and disconnect the VPN. Sign in, then reconnect. Always-on VPN does not override manufacturer background restrictions.

Screen lock and network changes: troubleshoot disconnects by symptom

Test one change at a time with the same config and node; don't change your subscription, DNS and battery settings all at once. These are troubleshooting steps, not test results for a specific phone. Note when each issue occurs so you can match it to timeouts, reconnects or service stops in the logs.

1. Baseline with the app open: Connect to Wi-Fi and visit two different sites. Confirm the connection history shows the destination and selected policy.
2. Screen-lock test: Lock the screen for 5 minutes, then test for 15. After unlocking, check that the service is still running and new requests succeed.
3. Network-switch test: Turn off Wi-Fi and switch to mobile data, then switch back. Existing TCP connections may drop; focus on whether new connections recover.
4. Restart test: Enable the required autostart or Always-on VPN options, restart the phone and check the status both before and after unlocking.

Use the logs to choose your next step

• Service has stopped: Check battery restrictions, autostart permissions, competing VPNs, and whether a cleanup tool or force stop was used.
• Service is running, but DNS times out: Check the config’s DNS upstreams, network reachability and Android’s Private DNS setting. Change one thing at a time and keep a record of the original settings.
• Only one app is affected: Check the per-app list, matched rules and the app’s network permissions. Don't reset the entire config as a first step.
• All proxied requests time out, but direct connections work: Check the node and proxy group. A latency check isn't enough; test a connection to the actual destination too.
• Mobile data works, but Wi-Fi doesn't: Check for captive portal sign-in, an old manual proxy and router restrictions before changing client settings.

Android Private DNS and the DNS module in your config operate at different layers. The resulting request path depends on the Android version, client and traffic interception method. For comparison, you can temporarily set Private DNS to Automatic, but turning it off is not a universal fix for disconnects.

Keep your config and logs to avoid repeating troubleshooting

After setup, note the client name and version, Android version, connection mode, per-app list behavior and battery settings. When reporting an issue, include the time it occurred, whether you were on Wi-Fi or mobile data, and relevant logs with sensitive details removed. Don't share subscription URLs, node passwords or access tokens.

Keeping the VPN service running in the background uses power. Actual battery use also depends on traffic, node protocol, DNS requests, speed-test frequency and network conditions. There's no need to run batch speed tests on every node regularly. Reduce unnecessary tests and log output first, then compare Android’s battery usage stats. A persistent notification alone doesn't indicate abnormal battery drain.

To wrap up, grant VPN permission, remove necessary background restrictions, verify the per-app list, then decide whether to enable Always-on VPN and lockdown. If you need to choose a client, start with the client comparison. For basic import steps, see the Clash setup guide. Learn more about rules and DNS in Advanced Config.