Always-On VPN on Android: Setup & Why It Matters

Manually tapping "Connect" every time you open your VPN app works fine until the one time you forget — usually right when you join a new WiFi network without thinking about it. Android's built-in Always-On VPN setting removes that gap entirely, and it's worth understanding both what it does and what it costs you in exchange.

What Always-On VPN Actually Does

Always-On VPN is a setting built into Android itself (not the VPN app) that automatically reconnects your chosen VPN app whenever your device has an internet connection, without you needing to open the app or tap Connect manually. It applies across WiFi and mobile data, and reconnects automatically after your device reboots or the VPN briefly drops.

Lockdown Mode: The Stricter Option

Alongside Always-On, Android offers an optional "Block connections without VPN" setting (often called lockdown mode). With it enabled, your device blocks all internet traffic outright if the VPN isn't connected, rather than silently falling back to your unprotected connection. This is the closest thing to a system-level kill switch on Android — it trades occasional connectivity interruptions for a guarantee that nothing ever leaves your device unencrypted.

Why It Matters More Than It Seems

Without Always-On, there's a real and common gap: you join a new WiFi network, get distracted before opening your VPN app, and end up browsing unprotected for a few minutes without realizing it. On a device that moves between networks constantly — home, mobile data, work, public WiFi — that gap adds up. Always-On closes it by making protection the default state rather than something you have to remember to trigger.

Setting It Up on Android

1. Install CarrotVPN from the Google Play Store and connect at least once, so Android recognizes it as an available VPN app
2. Open Android Settings and go to Network & Internet › VPN
3. Tap the gear icon next to CarrotVPN in the list of VPN apps
4. Enable "Always-on VPN" for CarrotVPN
5. Optionally enable "Block connections without VPN" for the stricter lockdown behavior

What to Expect Once It's On

If Something Stops Working

• No internet at all after enabling lockdown mode: open CarrotVPN directly and confirm it connects normally; some networks briefly block new VPN handshakes on first join
• An app that needs to bypass the VPN (rare, but occasionally needed for local network tools): Always-On generally doesn't support per-app exceptions on its own — that requires split tunneling, a separate setting
• Battery concerns: a well-optimized app on WireGuard, like CarrotVPN, adds minimal ongoing battery drain compared to older protocols, even running continuously

Quick Checklist

• Connect to CarrotVPN at least once before enabling Always-On, so Android recognizes it
• Turn on Always-On VPN in Android's Network & Internet settings for automatic protection
• Consider lockdown mode if you want a hard guarantee against any unprotected traffic
• Expect occasional connectivity interruptions with lockdown mode — that's the trade-off for the guarantee

Related Articles