How to Set Up a VPN on Android from Scratch: Install a Client, Import a Subscription, Verify It Works

Setting up a VPN on Android takes just four steps: install a client, import a subscription link, grant the system VPN permission, and verify it really works. The hard part isn't the theory — it's knowing which menu each step lives in and what you should see once you tap. This guide walks through the whole process in the order you'll actually do it, spelling out what to tap and what to expect, and finishes with a troubleshooting order for when something goes wrong.

This article is for anyone using a VPN on Android for the first time. No root and no custom ROM required — Android has a built-in VPN interface, and any client that connects through it has to be approved in a system dialog. The menu paths below follow common Android versions; names may differ slightly between manufacturers.

Three things to have ready first

Before you start, make sure all three are within reach — it saves a lot of backtracking.

• An Android phone. The system VPN interface has been part of Android since 4.0, and it needs neither root nor any extra certificate.
• A working subscription. Once your account is set up, the subscription link is on the download page in your user panel. Getting started doesn't require an email address.
• A network connection that works. Your phone has to be able to reach the subscription URL the first time you import it. If it won't load, switch between Wi-Fi and mobile data once and try again.

A “subscription” is the standard approach for services like this: the server encodes your route information into a single link, and the client pulls it to build the node list automatically. When routes change, one refresh in the client syncs everything — no hand-editing config files, which is what makes it less work than importing nodes one by one.

Getting a client: which of the two paths to take

There are two kinds of client you can use on Android, and which one you pick depends on the subscription format you have.

Path one: get it from the download page in your panel

VPNOh's download page offers clients that match your subscription. Format and client are paired automatically, so you don't have to work out which link type you have — just install and import as prompted. If it's your first time, start here.

Path two: use a general-purpose client

If you already have a client you're comfortable with, you can keep using it. Common choices include v2rayNG, Clash Meta for Android, Hiddify, and NekoBox; they run on different cores such as Xray, mihomo, and sing-box, and each has its own requirements for subscription formats.

There are two main categories of subscription format:

• Universal subscription: a base64-encoded string of node links (ss://, vmess://, vless://, trojan://, and so on) that clients like v2rayNG and NekoBox can parse directly.
• Clash config: a complete YAML configuration that only clients built on the mihomo (Clash Meta) core can read.

Pasting a Clash config into a client that only understands base64 usually gives you a “parse failed” error, or an empty node list after updating. When that happens, check whether the formats match before you suspect the link itself.

Importing a subscription: what to tap at each step

The example below uses pasting a subscription link into the client; the whole process takes about two minutes.

1. Find the subscription link on the download page in your user panel and copy it in full. These links are usually long, so make sure you don't miss the characters at the end.
2. Open the client, go to the “Subscription” page, and tap “+” or “New subscription.”
3. The name can be anything you like, such as VPNOh; paste the link into the address field. Some clients can detect it from the clipboard automatically.
4. Save, then tap “Update” or “Refresh” and wait for the node list to appear. The number of nodes should match the number of routes shown in your panel.
5. Select a node and go back to the home screen to tap connect; you can also run a latency test first and pick the node that responds fastest.

Once the import is done, use these checks to confirm the subscription was actually read:

• ✅ A node list appears under the subscription entry, with the same count as the routes in your panel
• ✅ After tapping “Update,” you can see the time of the last update
• ✅ Individual nodes show a specific protocol name (such as VLESS or Trojan) rather than “Unknown”
• ❌ The list is empty or shows “parse failed”: first check that the link was copied in full, then check whether the format matches

Granting VPN permission and the battery whitelist

The first time you tap connect, Android shows a system dialog titled something like “Connection request,” explaining that an app wants to set up a VPN connection. Tap “OK” to grant it; tap “Cancel” and the connection fails. The dialog is drawn by the system and appears once per client on the first connection, then never again.

Once the connection is up, a key icon appears in the status bar (a shield on some systems), and pulling down the notification shade shows “VPN connected.” Those two signs mean the tunnel is established — but they don't prove your traffic is really going out through the exit you picked. Full verification is in the next section.

Two system settings that are easy to overlook

• Only one VPN at a time. Android allows just one VPN app to be active at any given moment. If you have another VPN or accelerator app running on the phone, disconnect it first — otherwise the new connection will fail or the two will fight over the slot.
• “Always-on VPN” and “Block connections without VPN.” Both live in the system VPN settings. The first makes the system reconnect the chosen app automatically after a reboot; the second cuts off all traffic when the tunnel drops. They suit situations where stability matters a lot, but when misconfigured they show up as “no internet at all.”

Adding the client to the battery whitelist

Many manufacturer builds manage background apps aggressively. If you skip this, the connection may be cleaned up a few minutes after the screen locks, which shows up as “it keeps dropping after a while.” The entry points below are approximate and vary by version — go with whatever you find by searching for “battery” or “battery optimization” in Settings.

Verifying it works: four signals you can check yourself

The client saying “Connected” only means the tunnel was established. In rule mode, some traffic doesn't go through the tunnel by design, so “connected” isn't the same as “working.” Check the four items below in order — you've only truly got it running when all four pass.

DNS is the item people overlook most. If domain names are still resolved by your local ISP's DNS after you connect, browsing can be unstable even when the exit address has changed — that's what's usually called a DNS leak. Most clients offer a “remote DNS” or “DNS over HTTPS” option; turn it on and run the test again.

Common snags and the order to check them in

Listed below from most to least frequent. Work from the top down and you'll cover almost everything a beginner runs into.

1. Subscription import fails. Three common causes: the link wasn't copied in full (truncated at the end, or an extra space), the format doesn't match (a Clash config imported into a client that only understands base64), or the current network can't reach the subscription URL. For the first two, redo the link; for the third, switch networks and try again.
2. It stays on “Connecting.” Try another node first; then check that the system time is accurate, since a clock offset can break the handshake for some protocols; if it still won't connect, switch protocol or port and retry.
3. It connects but pages won't load. Usually DNS isn't going through the tunnel, your routing rules are sending the target domain direct, or there's a conflict with the system's “Private DNS” setting. Try setting Private DNS to “Automatic” temporarily, then check the client's DNS options.
4. It drops after a while. The app isn't on the battery whitelist, it's being killed in the background, or a switch between Wi-Fi and mobile data forced a reconnect. Go back to the table in the previous section and work through it item by item.
5. It says the VPN is in use by another app. Android allows only one VPN at a time — disconnect the other app first, then connect.

For a more detailed breakdown of failure types and how to handle each one, see the site's troubleshooting guide; node selection and regional differences are covered on the routes page.

Summary: four steps, then three things to confirm

Back to the start: setting up a VPN on Android from scratch is four steps — install a client → import a subscription → grant permission and add the app to the battery whitelist → verify the exit and DNS. Once that's done, confirm three things: a key icon in the status bar, an exit address that matches the node's region, and DNS resolution that isn't handled by your local ISP.

VPNOh simplifies these parts of the process: the download page provides a matching client, and importing the subscription generates the node list automatically; traffic is protected with military-grade encryption; an account allows unlimited simultaneous devices, so a phone and a tablet can share one subscription; and getting started doesn't require an email address, with a 14-day no-questions-asked refund.

If you don't have a subscription yet, you can start free; if you'd rather compare tiers first, the pricing page covers prices and data allowances. Other platforms follow much the same process; the main differences are where the permission dialogs appear and where background management lives.