Clash for Android: VPN permission and battery optimization settings

First, identify the issue: VPN permission or background restrictions

If the connection fails as soon as you start the app, check VPN permission first. If it works with the screen on but drops when locked, check battery and background restrictions. These issues have different fixes. Don’t reinstall the client at the first sign of a connection drop, and don’t change DNS, nodes, and rules all at once—you won’t know which change helped.

This guide focuses on Android’s built-in VPN mode. Clash for Android 2.5.12 is a discontinued client; use it only as a reference for recognizing menus, not as a recommended current version. Other Android clients using cores such as mihomo may label buttons differently, but the troubleshooting order for system permissions, battery restrictions, and VPN conflicts is the same.

• Stops immediately after tapping Start: Check whether you dismissed the system connection prompt, another VPN is running, or the configuration failed to load.
• Stops after a few minutes with the screen locked, then works again when you open the app: Check battery settings, background activity, and the manufacturer’s autostart controls first.
• VPN shows as connected, but some sites won’t load: Check your node, rules, DNS, and per-app routing before blaming background process cleanup.

What does VpnService permission actually allow?

VpnService is Android’s API for VPN apps. The client uses it to create a local virtual network interface, receive network traffic routed to it by the system, and let its proxy core decide—based on your configuration—whether to connect directly, use a proxy, or block the connection. This virtual interface is commonly called a TUN interface. It handles IP packets, not just browser HTTP requests.

So, seeing a VPN key icon on your phone doesn’t mean all traffic goes to the same remote VPN server. Where traffic goes depends on your rules, policy groups, selected node, and app exclusion settings. DIRECT means the client forwards traffic directly; proxy rules send it through the assigned node.

System VPN permission and importing a configuration are separate steps

• Import a subscription: Adds nodes, rules, policy groups, and other settings to the client.
• Allow VPN connection: Lets the app create a system-level local VPN interface.
• Allow background activity: Reduces the chance that the client’s service will be restricted when the screen is off.

Check all three separately. Importing a subscription doesn’t grant VPN permission, and granting permission doesn’t mean a node is working. Android typically allows only one active VPN in a personal profile. Another proxy client, firewall, or local-VPN-based filtering app may take over the connection. Work profiles have separate VPN management rules, so check the device’s policies.

First launch: grant VPN permission and verify the connection

1. Load a configuration first. Import a subscription from the client’s Config page, update it, then select the configuration you want to use. A configuration that appears in the list but hasn’t been enabled may not start correctly.
2. Temporarily stop other VPNs. Open Android Settings and search for “VPN” to check that no other app is using the connection. Also check whether ad blockers, packet capture tools, or similar apps are using a local VPN.
3. Return to the client and tap Start. When the connection is first created, Android displays a prompt explaining that the app wants to set up a VPN connection. Check the app name, then tap “OK” or “Allow.”
4. Check both status screens. The client should show that it’s running, and the system VPN page should show that the app is connected. Status bar icons vary by system, so don’t rely on the icon alone.
5. Test real traffic. Open a site that normally works without a proxy, then visit a destination that should use the proxy. Check the client’s connection history or logs to confirm that the expected rule was applied.

If you accidentally tapped Cancel, tapping Start again will usually prompt you to grant permission; there’s no need to clear the app’s data right away. If the prompt doesn’t appear after several tries, check whether the system VPN page already shows a connection, then review the client’s error logs. Device management policies may also prevent adding a VPN.

Notification permission on Android 13 and later

Since Android 13, notification permission is separate from VPN connection permission. Allowing notifications makes it easier to check service status and stop the connection from the notification shade. Denying notifications does not revoke VPN permission or prove that the foreground service isn’t running. Check the system VPN status first, then the client’s service status.

Always-on VPN: understand the two separate switches

On near-stock Android, the usual path is Settings → Network & internet → VPN → tap the gear next to the app. Samsung and other manufacturers may put it under Connections → More connection settings → VPN. If you can’t find it, search for “VPN” in Settings.

Not all clients support “Always-on VPN.” Android has offered this feature since version 7.0, but apps can declare that they don’t support it, and managed devices may restrict changes. If the switch is disabled or missing, check whether the client supports it. Changing your subscription won’t make this system setting appear.

Confirm the connection is stable before enabling the block switch. With “Block connections without VPN” on, a client startup failure, configuration loading error, or service that doesn’t restart can leave your entire phone without internet access. Apps excluded from the VPN may also be blocked, so don’t assume that an excluded app will still connect directly.

Keep a recovery option handy for your first test: know where to find the system VPN settings. If you lose internet after enabling the block, turn it off there before troubleshooting the client. Always-on VPN can’t guarantee that a proxy node will stay available, and it doesn’t replace battery or background settings.

Battery optimization exemptions: adjust app settings, then check manufacturer controls

Android’s Doze mode saves power when a device is idle; app standby and manufacturer-specific background controls can impose further limits. “Adding an app to the battery whitelist” usually means allowing it to run more freely in the background, not disabling power saving across the phone. Change settings for the client you actually use rather than removing restrictions for every app.

Start with these three steps

1. Long-press the client icon → App info → Battery. If you see “Unrestricted,” select it. If your device uses a setting such as “Allow background activity,” make sure it’s enabled.
2. Search Settings for “Battery optimization.” If your device has a separate list of optimized apps, switch to “All apps,” find the client, and set it to “Don’t optimize.” Some systems use the same setting as the previous step, so you may not find two separate switches.
3. Check the current battery saver mode. Turn off Ultra battery saver or Extreme power saving while testing. Whether standard Battery Saver affects the service depends on the device, so verify it on your phone even if the app is already exempt.

Additional background settings by manufacturer

These are examples of menu names, not fixed paths for every version. HyperOS, One UI, EMUI, and other systems may move settings after updates. Use the app’s App info page and search within Settings to find the current options.

Locking an app in the Recent apps screen can help prevent it from being removed by a one-tap cleanup, but usually doesn’t exempt it from system battery restrictions. Also, swiping away a task card, the system reclaiming a process, and Force stop are not the same thing. After a force stop, you’ll usually need to open the app manually; don’t expect autostart to bring it back immediately.

VPN drops when the screen is off: separate service exits from network issues

Change one category of setting at a time and record when you test. The 5- and 15-minute intervals below are suggested observation windows, not guarantees based on testing a particular phone. Passing a short test doesn’t prove the connection will stay up overnight.

1. Set a baseline with the screen on. Use a node you’ve confirmed works, note whether you’re on Wi-Fi or mobile data, check the VPN status, and confirm that a test site loads.
2. Lock the screen for 5 minutes. After unlocking, check the system VPN page first—don’t open the client yet, as that could restart it and hide the fact that it stopped.
3. Test again for 15 minutes. Note whether the VPN is still connected, whether the first page request succeeds, and whether the client log shows a service restart, connection timeout, or DNS resolution failure.
4. Test network switching. Make a new request after switching from Wi-Fi to mobile data, then again after switching back. It’s normal for an existing TCP connection to drop during a network change; check whether a new connection works.
5. Test a reboot last. Check whether the connection recovers after startup and unlock. If VPN blocking is enabled, also make sure you can reach the recovery setting if the connection fails.

Use your observations to narrow down the cause

• System VPN is disconnected, but reconnects when you open the client: Check background restrictions, crash logs, and whether another VPN took over. A battery exemption can address only some of these causes.
• System VPN is still connected, but all new requests time out: Check the selected node and upstream network. Retest with another node you know works before blaming DNS.
• Logs show DNS resolution failures: Check the DNS settings and whether the upstream resolver is reachable. Don’t treat an IP address typed into a browser as a definitive test; HTTPS certificates and virtual hosting can also affect access.
• Only one app has a problem: Check whether it’s excluded from the VPN, whether only selected apps are proxied, or whether the system restricts its background data. Also verify which policy the rules ultimately select.
• Only lock-screen notifications are delayed: Check the target app’s battery restrictions, push notification channel, and background data permissions too; changing Clash settings alone may not help.

Settings that are easy to confuse

If TUN is enabled, do I still need to allow the VPN connection?

Yes, with the standard Android local VPN setup on a non-rooted device. TUN refers to the virtual network interface or related traffic-handling mode; VpnService is the system API the client uses to request that capability. A TUN field in a subscription, a traffic-handling switch in the client, and Android VPN permission are separate things. Whether the client reads those fields depends on its implementation.

Does a battery optimization exemption guarantee the VPN stays connected?

No. An exemption reduces background restrictions, but network changes, node failures, memory pressure, client crashes, and manually force-stopping the app can still interrupt the connection. Check the system VPN status, service logs, and actual new requests together—not just a latency test.

Will changing port 7890 fix VPN disconnects when the screen is off?

Usually not. Port 7890 is commonly used for a local HTTP or mixed proxy listener in some configurations, but it isn’t a fixed value for every client. It’s unrelated to whether Android allows the service to run in the background. Investigate the listener port only if the logs explicitly report a port conflict or a failed local proxy connection.

Do I need to configure this again in a cloned app or work profile?

Usually, check each one separately. App instances in different users or work profiles have their own permissions and management settings, so an exemption in your personal profile doesn’t prove that the work profile’s instance is allowed to run. An administrator may also control VPN settings on a managed device. If a setting can’t be changed, check the device’s management policy first.

Final checklist: Enable the configuration, grant system VPN permission, make sure another VPN isn’t taking over, allow the app to run in the background, and adjust the manufacturer’s battery restrictions. Then test with the screen locked and after switching networks. If the issue persists, keep a record of when it happened, the system and client versions, and redacted logs; that’s more useful for troubleshooting than repeatedly reinstalling the app. For basic setup, see the user guide. For unfamiliar terms, consult the glossary.