Clash on Android and VpnService: Understand the Client, Core and System Permissions
Using a Clash client on an Android phone typically involves three steps: importing a working configuration, starting the proxy core and allowing the client to create a system VPN interface. The third step relies on Android's VpnService. It does not mean adding a remote VPN account, nor does it mean all traffic will pass through a proxy node.
The client receives IP traffic routed through the VPN interface and passes it to the core for processing. In Rule mode, rules can still direct requests to DIRECT, a proxy group or a reject policy. So the VPN icon in the status bar only confirms that the system VPN interface is active; it doesn't tell you which route a particular website is using.
- The client handles the interface, subscription management, system permissions and background service.
- The Clash or mihomo core handles protocol connections, rule matching, DNS and related logic. Supported fields depend on the core version in use.
- VpnService handles the Android-side traffic entry point and lifecycle. It does not check whether a subscription has expired or a proxy node is available.
An Android client's VPN mode uses a virtual interface much like TUN mode on desktop, but the configuration options aren't standardized. Don't copy desktop service installation steps or blindly add a full tun: section just to route phone traffic.
First connection: Handle the VPN permission prompt and connection conflicts
Follow this order: configure → choose a policy → start → grant permission
- Import a subscription from the client's “Configuration” or “Profiles” page. Make sure it downloads successfully, then select the configuration you want to use.
- Open the “Proxy” or “Proxies” page and select an available policy. For initial troubleshooting, use Rule mode and avoid adding per-app exclusions until later.
- Tap the client's start switch. When Android displays a “Network connection request” or similar system prompt, verify the app name and tap Allow.
- Return to the client and check its running status, connection log and notification. Open a new request in your browser and confirm that it appears in the log.
The system prompt explains that the app can monitor network traffic; this is part of the VpnService permission. It does not automatically give the app access to all HTTPS plaintext. However, the app can process traffic routed through the interface and may see destination addresses and some DNS information, so grant permission only to a client you trust.
Can't grant permission? Close screen overlays first
If the Confirm button is unresponsive, temporarily turn off floating windows, eye-comfort filters, screen overlays and other tools that draw over the screen, then try connecting again. Some systems block sensitive permission actions while another app is overlaying the screen. Work profiles and company-managed devices may also restrict VPN use. If you see an administrator notice, contact your IT administrator instead of repeatedly reinstalling the app.
Usually, only one VpnService connection can be active per user or profile. Another VPN, a firewall that uses a local VPN, a filtering tool or a packet-capture app may replace the current connection. For troubleshooting, stop these apps before starting the Clash client. Work and personal profiles may also behave differently depending on device management policies.
Android 13 and later: Check notification permission too
Android 13 introduced runtime notification permission. Denying it doesn't necessarily stop a foreground service immediately, but its ongoing notification may not appear in the notification shade. Go to Settings → Apps → the client → Notifications and allow essential service notifications so you can see whether the connection is still active. Notification and VPN permissions are separate settings.
Battery optimization, background activity and auto-start: what each setting does
“Ignore battery optimization,” “Allow background activity” and “Auto-start” are different settings. Enabling just one won't guarantee that the system keeps the connection alive in every situation. Understand what each setting controls, then adjust it based on how your device behaves.
| Setting | What it does | What it doesn't guarantee |
|---|---|---|
| Battery usage: Unrestricted | Reduces battery restrictions on background activity; the system decides how the setting is applied. | Doesn't prevent the process from being stopped or fix an unavailable proxy node. |
| Allow background activity | Lets the app continue essential tasks after you leave it. | Doesn't automatically connect the app after a phone restart. |
| Auto-start or background auto-start | Allows the app to launch in response to certain system events. | The client still needs to support boot launch or connection recovery. |
| Lock in recent apps | On some manufacturer-customized systems, makes it less likely that a “Clear all” action will close the app. | Not an Android guarantee that the app will stay alive; it can't prevent a force stop. |
After changing these settings, reopen the client and connect manually once. If you previously force-stopped the app in system settings, you'll usually need to launch it yourself before normal background behavior resumes. Setting battery usage to Unrestricted alone won't restart a stopped service.
Where to find battery optimization settings on popular Android devices
These are examples of where to find the settings on common Android versions; wording varies by device. OS updates, regional builds and manufacturer customizations can move menu items. If you can't find a setting, long-press the app icon, open App info and look for Battery, Power management or Auto-start.
Pixel and near-stock Android 14 and 15
- Go to Settings → Apps → See all apps → the client → App battery usage.
- Turn on “Allow background usage.” If the page offers “Unrestricted,” select it. On some versions, you need to open the background usage option to see the available modes.
- Open Notifications for the same app and make sure service notifications are enabled.
Stock Android typically doesn't have a manufacturer-style auto-start manager. Whether the app can resume after a restart depends mainly on client options, system restrictions and the device's unlock state.
Xiaomi MIUI 14 and HyperOS
- A common path is Settings → Apps → Manage apps → the client → Battery saver. Select “No restrictions.”
- Auto-start is often under Settings → Apps → Permissions → Autostart. Some HyperOS versions call it “Background autostart.”
- If the recent apps screen offers an app-lock feature, you can lock the client's card to reduce the chance of closing it when clearing recent apps.
Some versions put app battery settings under Settings → Battery & performance. Follow the options shown on the app details page. “Display pop-up windows” is not required for VPN operation.
Samsung One UI 6 and 7
- Go to Settings → Apps → the client → Battery, then select “Unrestricted.”
- Go to Settings → Battery → Background usage limits. Check Sleeping apps and Deep sleeping apps, and remove the client from those lists.
- If “Never auto sleeping apps” is available, try adding the client. Some versions display apps set to “Unrestricted” in a different list.
Power saving mode can still affect background networking and system behavior. If the issue only occurs with power saving enabled, turn it off for a comparison test before deciding whether to change your everyday settings.
OPPO and OnePlus: ColorOS and OxygenOS
A common path is Settings → Apps → App management → the client → Power usage or Battery usage. If available, enable “Allow background activity” and “Allow auto-launch” as needed. Some versions also offer Settings → Battery → More settings → Optimize battery use, where you can find the client and change its optimization policy.
vivo, iQOO and HONOR devices
On vivo and iQOO devices running OriginOS, a common path is Settings → Battery → Background power consumption management. Allow high background power use for the client. Find auto-start under i Manager → App management → Permission management. On HONOR devices running MagicOS, go to Settings → Apps → App launch management. Turn off automatic management for the client, then allow auto-launch, secondary launch and background activity as needed. Options may be combined in some versions; follow the system's guidance.
Always-on VPN, per-app proxying and DNS: what to know
“Always-on VPN” doesn't keep the app process alive
VPN settings are commonly under Settings → Network & internet → VPN. On Samsung and some other devices, look under Connections → More connection settings → VPN. Tap the settings icon next to the client. The “Always-on VPN” option appears only if both the app and system support it. It lets Android try to maintain or restore the VPN, but it can't guarantee recovery from every crash.
“Block connections without VPN” is a stricter setting: network access may be blocked whenever the VPN isn't connected. Leave it off if you need to use a hotel or airport captive portal, or you're testing an unstable configuration. Before enabling it, test disconnecting, reconnecting and restarting, and make sure you know how to return to VPN settings to turn it off.
If only one app can't connect, check per-app routing first
An Android client may offer “Bypass selected apps” or “Proxy selected apps.” These options do the opposite: the first excludes listed apps, while the second routes only the listed apps. If your browser works but another app doesn't, check what the current list means before reviewing domain rules. Apps in a work profile may also fall outside the personal profile's VPN routing.
Keep Private DNS separate from the client's DNS settings
Android's “Private DNS” is a system-level DNS over TLS setting. The dns: setting in a client configuration is handled by the proxy core and depends on how the client routes traffic. How the two interact depends on DNS routing, the VPN implementation and whether an app uses its own encrypted DNS. Don't assume that enabling a VPN sends every app's DNS requests through the same resolver.
If the log shows DNS lookup timeouts, temporarily change system Private DNS from a specified hostname to “Automatic,” and turn off your browser's secure DNS for a controlled test. Once you identify the cause, choose your long-term settings. Don't treat disabling all encrypted DNS as a standard setup step or copy DNS interception settings that don't match your core.
Troubleshooting disconnects when the screen is locked: distinguish app shutdowns, network changes and proxy failures
“No internet after locking the screen” describes a symptom, not the cause. The system may stop the app, Wi-Fi may switch to mobile data, a proxy node may fail or DNS may time out—all can make websites inaccessible. Check the connection status before changing settings to avoid reinstalling the app without solving the problem.
| What you see | Check first | What to try next |
|---|---|---|
| VPN icon disappears and the client shows as stopped | The process stopped, another VPN took over, or the system restricted background activity. | Check background permissions and the log leading up to the shutdown. Temporarily stop other VPN apps. |
| VPN is still connected, but proxy requests time out | Proxy node availability, network changes and policy group selection. | Switch to a known-working node and test separately on Wi-Fi and mobile data. |
| Only some domains won't load | DNS, matched rules or the destination service's status. | Check the connection log, matched policy and DNS errors for the affected domain. |
| The client doesn't connect after restart, but works when started manually | The client's boot-start option and the system's auto-start permission. | Check whether it resumes after you unlock the device, then decide whether to use Always-on VPN. |
Reproduce the issue consistently; test durations aren't system guarantees
- Note the phone model, Android version, client version and core version. Save screenshots of the current settings.
- Stay on Wi-Fi, start the proxy and visit a website. Record the time and active policy.
- Lock the screen for 10 minutes, unlock it and make a new request. This is a first-round test interval, not a universal Android process-kill threshold.
- Repeat with the screen locked for 30 minutes. Then separately test a new connection after turning off Wi-Fi and switching to mobile data.
- Change just one setting per test, such as the battery policy, so you can tell whether it helped.
Existing TCP connections may drop when the network changes, even if the VPN service is still running. Judge the result by whether new connections recover, not by whether every active transfer continues uninterrupted.
To troubleshoot logs, search for entries such as timeout, DNS and network unreachable, then compare their timestamps with the issue. Before reporting a problem, remove subscription URLs, access tokens, proxy passwords and personal browsing records. Include only the relevant error context.
Common questions about Clash running in the Android background
Is it normal to see the VPN permission prompt every time I connect?
After an app has been authorized, Android usually doesn't ask again every time. The prompt may reappear after using another VPN, reinstalling the client, switching profiles or changing device management policies. Check the app name in the prompt, and don't mistake a system permission request for a subscription renewal notice.
Will swiping the app away from Recents always stop the proxy?
Not necessarily. On standard Android, removing a task from Recents isn't the same as force-stopping the app, and its foreground service may keep running. Manufacturer-customized systems and clients may add their own exit behavior. Check the VPN status and client logs. To keep the connection active, avoid one-tap cleanup tools and review the manufacturer's background management settings.
Why do I still have to connect manually after restarting, even with auto-start enabled?
Auto-start permission only allows the app to launch. The client must also implement and enable boot launch or connection recovery, and it needs access to a configuration file. Some features may not resume until you've unlocked the device. If the client doesn't support these features, the system auto-start switch alone can't connect it automatically.
The connection drops when the screen turns off. Should I change subscriptions first?
First check whether the client is still running. If its service has stopped, address background restrictions or VPN conflicts first. If the service is active but multiple nodes fail on the same network, check the network and DNS. A node issue is more likely when the errors are limited to specific nodes and switching nodes fixes them.
After changing settings, verify four things: the first VPN permission request succeeds, new connections work after you leave the app, requests recover after the screen is locked, and the client reconnects after a network change. Testing these separately makes problems easier to pinpoint than enabling every permission at once, and gives you a useful checklist after system updates.