Android Clash Meta Setup: VPN Permissions, Per-App Proxying & Battery Optimization
Set up Android VPN permissions, always-on VPN, per-app proxying, and battery optimization exemptions to help prevent background disconnects.
Understand the difference between Android VPN and proxy nodes
Clash Meta clients for Android typically use Android's VpnService to create a local virtual network interface, then pass the traffic it receives to the Mihomo core. A VPN key icon in the status bar means Android has established a VPN connection. It does not mean a subscription node is reachable or that every app's traffic is routed through a proxy node.
Every request is subject to two separate decisions: Android first decides whether to route an app's traffic through the VPN; the core then applies its rules to choose a direct connection, a proxy group, or a block. In Rule mode, requests matching DIRECT may still pass through the VPN interface before the core sends them directly.
- VPN permission: Allows the client to receive network traffic routed to it by Android.
- Subscription and configuration: Provide nodes, proxy groups, DNS, and routing rules; they do not grant Android VPN permission.
- Battery settings: Reduce the chance of Android stopping the app in the background; they cannot fix an unavailable node.
Android VPN permission prompt: first connection and repeat requests
Steps for the first connection
- Import a working configuration, make sure it loads, and select a node in the proxy group.
- Tap Start or Connect in the client. When Android shows a connection request, confirm that the requesting app is the client you just opened, then tap Allow.
- Check the Android VPN status and the client logs, then open a site to verify that the connection works.
- Open a site that should connect directly and check that rule-based routing behaves as expected. Don't use a latency test alone to judge how all traffic is routed.
Android usually allows only one active VPN per user or profile. Ad blockers, firewalls, packet capture tools, and work VPNs may use the same interface. When a new connection replaces the old one, the previous client may show as disconnected. Adding nodes or changing ports won't fix this.
If the permission prompt appears every time, check these first
First, check whether you're switching between VPN apps or recently reinstalled the app, cleared its data, or removed its VPN profile. If another app was granted permission, the current client may need to request it again. A work-profile VPN may also be restricted by device management policies; personal and work profiles have separate states.
If you can't tap the permission prompt, close overlays such as floating windows or screen filters, then try connecting again from Android Settings or the client. Don't disable unrelated Android security features just to get past the prompt. On a managed device, check with your administrator whether personal VPN connections are allowed.
Always-on VPN and blocking connections without a VPN
On near-stock Android, go to Settings → Network & internet → VPN, then tap the settings icon next to the client. On Samsung devices, the usual path is Settings → Connections → More connection settings → VPN. Android 7.0 and later support always-on VPN, but whether the option appears and works depends on the client and device policies.
| Setting | What it does | Check before enabling |
|---|---|---|
| Always-on VPN | Tells Android to keep the selected VPN service running after startup and when a connection drops | The client supports it and can load its configuration in the background |
| Block connections without VPN | Restricts network traffic that bypasses the VPN | The device may lose all network access if the VPN is unavailable |
| Start client on boot | Lets the app handle its startup process after the device boots | The manufacturer's autostart permission is enabled |
Start by enabling only Always-on VPN. Restart your phone and unlock it once, then check that the client reconnects. After testing with the screen locked and while switching between Wi-Fi and mobile data, decide whether to enable Block connections without VPN. This option restricts network access; it is not a background keep-alive setting.
Per-app proxying: allowlists, blocklists, and rule mode
Look in the client settings for options such as Per-app proxy, Access control, or App selection. These may all refer to Android's VPN app-filtering feature. Don't rely on the switch label alone; read the explanation to see whether it includes only selected apps or bypasses them.
What the two app lists actually do
- Only selected apps use the VPN: This is an allowlist. Use it to route only a browser and a few other tools through the VPN while other apps keep their normal network route.
- Selected apps bypass the VPN: This is a blocklist. Use it to route most apps through the VPN while excluding a few that specifically need a local network route.
- Rules still apply after an app enters the VPN: Selecting an app does not force it to use a proxy node. Domain, IP, and final fallback rules still determine its route.
Android's underlying VPN setup cannot combine an allowlist and a blocklist in the same build. A client may let you switch between these modes. After changing the list, disconnect and reconnect the VPN to rebuild the interface and apply the changes; returning to the home screen may not be enough.
Test with two apps, not just one website
- Set one browser to use the VPN and another to bypass it. Note which list mode is selected.
- Reconnect the client, then fully close and reopen both browsers to reduce the effect of reused connections.
- Visit the same destination in both browsers while checking the client's connection log. Requests routed through the VPN should appear in the log with the matching rule or exit route.
- After installing a new app, check the list again. In allowlist mode, new apps usually aren't added automatically; in blocklist mode, new apps usually use the VPN by default.
Dual-app instances, work profiles, and separate Android users may have different app identities, so selecting a browser in your personal profile may not include its work-profile copy. Browsers may also use their own encrypted DNS, which can differ from Android's DNS route. Note this during troubleshooting; DNS results alone don't prove that per-app settings have failed.
Battery optimization exemptions: allow background activity and autostart
Android Doze, App Standby, and manufacturer background controls are separate restrictions. Clients generally use a foreground service to keep the VPN running and show an ongoing notification, but a foreground service is no guarantee that the app will never stop. Allowing a proxy client to run in the background also doesn't make every node in its subscription available.
Long-press the client icon and open App info. Find Battery or App battery usage and set background access to Unrestricted or Allow background activity. If Android provides a Battery optimization list, switch to All apps, find the client, and allow it to run without optimization. Common menu paths are listed below, but labels may change after system updates.
| System | Common path | What to change |
|---|---|---|
| Pixel / near-stock Android | Settings → Apps → See all apps → client → App battery usage | Allow background usage; select Unrestricted if available |
| Xiaomi HyperOS / MIUI | App info → Battery saver; search Settings for “Autostart” | Select No restrictions and allow the client to autostart |
| Samsung One UI | Settings → Battery → Background usage limits | Remove the app from Sleeping and Deep sleeping apps; optionally add it to Never auto sleeping apps |
| OPPO / OnePlus ColorOS | App info → Battery usage; search Settings for “Autostart” | Allow background activity and check the autostart permission |
| vivo / iQOO | Settings → Battery → Background power consumption management; search Settings for “Autostart” | Allow high background power usage or the equivalent exception, and enable autostart |
| Huawei / HONOR systems | Search Settings for “App launch” | If available, switch to manual management and allow autostart, secondary launch, and background activity |
If the client doesn't appear in a particular allowlist, don't keep reinstalling it. It may already be unrestricted, or your system may manage it elsewhere. Return to App info and check the actual battery policy. Locking the app in Recent apps can help, but it doesn't replace battery settings or startup permissions.
Check notifications on Android 13 and later
Allowing notifications makes it easier to check the VPN foreground service and use its stop button. On Android 13 and later, denying notification permission doesn't necessarily prevent a foreground service from starting. So an ongoing notification missing from the notification shade doesn't prove that the VPN has stopped. Also check Android's VPN status, the client's running state, and its connection log.
Don't turn off every battery protection setting on your phone for one client. Adjust only that app first, then test. If Extreme Battery Saver or a similar mode is enabled, the usual app exemptions may not be enough to keep the client running as before; note this in your test results.
Troubleshoot VPN disconnects when the screen locks: app exit, network changes, or node failure
Run a repeatable test in this order. The 10- and 30-minute intervals below are suggested observation periods, not measured battery-life results or guarantees that the app will stay active. Change one setting at a time so you can tell what helped.
- Record a baseline: Connect to Wi-Fi, start the client, and note the time, selected node, proxy mode, and Android VPN icon status.
- Lock the screen for 10 minutes: After unlocking, check whether the VPN is still connected before opening a target site. If it reconnects only after you open the client, focus on background restrictions and service logs.
- Extend the test to 30 minutes: Repeat with the same configuration so brief periods with the screen on don't mask background issues.
- Switch networks: Move from Wi-Fi to mobile data and back. If the VPN icon stays visible but requests time out, check the logs for reconnect attempts, DNS errors, and node connection errors.
- Test after a restart: Restart the phone and unlock it, then check separately whether always-on VPN, autostart, and configuration loading work.
If the VPN icon disappears and the client shows as stopped, the service may have exited or been replaced by another VPN. If the icon remains and the rule log looks normal but the destination times out, check the node, DNS, and network changes. If only one app fails, check its per-app mode and network settings first; don't immediately reset the entire subscription.
A checklist for long-term use
- Keep only the VPN you intend to use active, and know how it interacts with your ad blocker or work VPN.
- Note whether the per-app list uses allowlist or blocklist mode. Recreate the VPN after each change.
- Test always-on VPN first, then decide whether to block connections outside the VPN. Keep the recovery steps handy.
- Check both battery settings and autostart permissions; don't rely on locking the app in Recent apps alone.
- Keep results for screen-lock, network-switching, and restart tests. Retest after updating the client or Android.
For more on rules, DNS, and TUN settings, see the configuration guide, from beginner to advanced. For specific errors, start with the FAQ. When sharing troubleshooting details, include your Android and client versions, when the issue occurred, and relevant log excerpts. Hide subscription URLs, access tokens, and node passwords.