VPN on Android in the UK: EE, Three, O2, Vodafone and Wi-Fi fixes
tun0).
To get real protection, you must enable Block connections without VPN and verify IPv6 is protected (many 5G networks are IPv6-first).
Otherwise, you’re encrypted only part of the time.
Why Android privacy is harder than desktop
On a laptop, a VPN is usually a clean story: one network adapter, one routing table, one DNS path. On Android, you have additional identity signals (Google Play Services, cellular network identifiers, Wi‑Fi scanning, GPS assistance) and a more aggressive power manager that can pause background tasks. A VPN protects IP-level traffic, but it cannot “turn off” how your phone is designed to identify networks.
The goal of this guide is not to list apps from Google Play. It’s to explain what Android actually does under the hood, and how to configure a VPN so it behaves like a system security feature, not a “sometimes-on” encryption layer.
The Android VPN framework (VpnService API)
What is tun0 and why it matters
When you connect a VPN on Android, the OS creates a virtual interface (often visible as tun0) and gives the VPN app a controlled way to read and write packets.
The VPN app encrypts those packets and sends them to the VPN server over UDP/TCP. This is user-space networking.
Kernel vs user-space: why WireGuard often feels “instant”
WireGuard was designed to be simple and fast. On Android it still runs through app-space components, but its protocol is lightweight and tends to reconnect faster than OpenVPN. That reduces the “reconnect window” where packets might escape if your setup isn’t strict. If you want to understand protocols in depth, see Types of VPN Protocols.
| Layer | Controlled by | What can break | What to configure |
|---|---|---|---|
| Always-on + Block without VPN | Android system | Traffic leaks on reconnect/crash | Enable both toggles (system settings) |
Routing into tun0 |
Android + VPN app | Split tunneling mistakes | Decide which apps bypass VPN |
| DNS handling | Android + VPN app | DNS leaks / captive portals | Use private DNS or VPN DNS; test it |
| Transport protocol | VPN app | DPI blocking on mobile networks | Try WireGuard, OpenVPN TCP, or obfuscation |
| Battery management | Android system | VPN killed in background | Disable battery optimization for VPN app |
Battery impact: WireGuard vs OpenVPN on 5G
Most guides ignore power. But on Android, battery is security: when the OS kills your VPN app, your tunnel drops. Below is a practical comparison you can use as a baseline. Treat it as a “typical” range - your device, server distance, and network congestion matter.
| Protocol | Approx. drain | Reconnect behaviour | Best use case |
|---|---|---|---|
| WireGuard | 6 - 10% / hour | Fast handshake, short reconnects | Everyday browsing, streaming, travel |
| NordLynx (WireGuard-based) | 6 - 9% / hour | Fast + stable roaming | Best “set and forget” on Android |
| OpenVPN UDP | 9 - 14% / hour | Stable, but heavier | Older networks, compatibility |
| OpenVPN TCP | 11 - 16% / hour | More resilient through DPI | Restricted networks, hotel Wi‑Fi |
| IKEv2 | 7 - 12% / hour | Good mobility, varies by implementation | Quick reconnects, mixed networks |
Battery Decay Calculator (quick estimate)
This is a simple estimator to compare protocols. It does not read your battery; it helps you reason about trade-offs.
Android Security Hardening Checklist (interactive)
Choose your Android version
You’ll get the exact toggles to check (names can vary slightly by vendor skins).
The 5G & IPv6 challenge
Many mobile operators run IPv6-first or IPv6-only infrastructure, then translate traffic for legacy IPv4 services. If your VPN only tunnels IPv4, your phone can keep using IPv6 “outside” the tunnel. That’s why Android VPNs must be tested specifically for IPv6.
Practical next step: run a leak test and verify both DNS and IPv6 are protected. If you want the baseline theory, see DNS Leak Protection.
| Symptom | What it usually means | Fix |
|---|---|---|
| VPN “connected”, but IPv6 address still visible | VPN tunnels IPv4 only | Enable IPv6 in VPN settings or switch provider/protocol |
| Some apps bypass VPN while browser is protected | Split tunneling or vendor “optimised routing” | Disable split tunneling and retest; add app-level rules carefully |
| Leaks after sleep / roaming | VPN app paused by battery manager | Disable battery optimization for VPN app; use Always-on |
Split tunneling: power move (and the easiest way to leak)
The safest approach is to start with no split tunneling. Verify your tunnel is strict. Only then decide which apps may bypass VPN (for example, a bank app that flags VPN usage). For a deeper explanation of terms, see the VPN Glossary.
Restrictive networks and approved protocol fallback
On mobile networks, throttling and blocking is often DPI-driven (Deep Packet Inspection). If UDP-based tunnels keep dropping, try a TCP-based mode or an obfuscation/stealth option in your VPN app. It’s slower, but it can survive hostile networks. For encryption basics and why algorithms matter on phones, see VPN Encryption.
Where Android hides the real kill switch
Many users enable a “kill switch” inside the VPN app, but the OS-level control is what matters most. In Android settings, the kill switch is effectively Block connections without VPN. It prevents traffic from leaving your phone if the tunnel drops.
If you want a dedicated deep dive on this topic, read VPN Kill Switch.
Practical conclusion
FAQ
Does Android VPN protect all apps automatically?
Why does my VPN disconnect on Android when the screen is off?
How do I know if my Android VPN leaks IPv6?
Is WireGuard always best on Android?
✓ Leak Test (IP / DNS / IPv6 / WebRTC)
✓ Verification date:
Related guides
- Start withVPN on Windows 10 and 11 in the UK: adapters, DNS and connection recovery
- Then readVPN on Mac in the UK: profiles, DNS, Private Relay and network extensions
- Related caseVPN on iPhone and iPad in the UK: mobile handover, profiles and Private Relay
- If something failsVPN troubleshooting on UK broadband and mobile networks