Clash for Android VPN Permission & Battery Optimization Guide

First launch: Approve Android's VPN connection request

Select a working configuration in the client, then tap the start switch on the home screen. On first launch, Android usually displays a “Network connection request” or “VPN connection request.” Check that the app name in the prompt matches the client you just opened, then tap “OK.” If another VPN is already running on your device, disconnect it first to avoid confusing a connection switch with a problem.

VpnService is Android's API for creating a local VPN connection. Clash-based Android clients use it to create a virtual network interface and receive app traffic, then route that traffic directly or through a proxy node according to the configuration. A VPN icon means the local interface is up; it does not mean all traffic is routed through a remote node or that the nodes in your subscription are working.

Open the client's configuration page and confirm that a configuration is selected, not merely imported.
Return to the home screen, start the service, and approve Android's VPN connection request.
Pull down the notification shade and check whether the client shows that it's running. Some systems also display a VPN icon in the status bar or Quick Settings.
Keep the screen on. Open a site that normally works without a proxy, then test a site that requires one to check both routes.

If you tapped Cancel, starting the service again will usually bring up the permission prompt. If the prompt doesn't appear, check for another VPN, a work profile policy, or a device management restriction. Repeatedly importing your subscription won't help: subscription setup and system VPN permission are separate steps.

Know the difference: VPN permission, notifications, and background activity

Go to Settings → Apps → See all apps → select the client to open its app info page. Notifications, battery, and mobile data control different features; enabling one option doesn't mean setup is complete.

Setting	What it does	What it doesn't confirm
VPN connection permission	Allows the app to create a local VPN interface.	Doesn't confirm that nodes, DNS, or rules are working.
Notification permission	Lets you check the service status and stop it from the notification shade.	Allowing notifications doesn't remove background restrictions.
Unrestricted battery usage	Reduces restrictions on the app's background activity.	Doesn't guarantee the process will never be stopped.
Background data	Allows the app to use mobile data in the background.	Doesn't replace VPN permission or battery settings.

Android 13 and later require separate runtime permission for notifications. Denying notification permission does not deny VPN permission. The foreground service may still run, but its status controls might not appear in the notification shade. When troubleshooting, check both the client home screen and the system VPN page; don't rely on whether a notification appears.

Battery optimization exemptions: Check each setting in app info

Long-press the client icon, tap “App info,” then open “Battery” or “App battery usage.” If you see “Unrestricted,” “Optimized,” and “Restricted,” choose “Unrestricted” when troubleshooting disconnects with the screen off. Some systems call this “Allow background activity” or “Background power management”; menu names and locations vary by Android version.

Common paths on stock Android and Pixel

Go to Settings → Apps → See all apps → select the client → App battery usage. Check “Allow background usage” and choose “Unrestricted” if available.
On older versions, go to Settings → Apps & notifications → Special app access → Battery optimization. Switch the list to “All apps,” find the client, and select “Don't optimize.”
Go to Settings → Battery → Battery Saver. Turn Battery Saver off while troubleshooting to avoid stacking it with per-app restrictions.

Additional settings on manufacturer-customized Android

Xiaomi MIUI / HyperOS: Long-press the icon → “App info” → “Battery saver.” Select “No restrictions” if available. Then search Settings for “Autostart” or “Background autostart” and check the client.
Samsung One UI: Go to Settings → Battery and device care → Battery → Background usage limits. Make sure the client isn't listed under “Sleeping apps” or “Deep sleeping apps.” On some versions, “Battery” is a top-level menu.
Huawei EMUI / HarmonyOS: Search Settings for “App launch,” find the client, and review its manual management options. Allow auto-launch, secondary launch, and background activity as needed.

If you can't find a menu with the same name, search Settings for “battery optimization,” “background activity,” or “app launch.” These are common paths, but options vary by device. Change settings only for the client you use; there's no need to exempt every app.

“Lock app” in the recent apps screen is only a supplementary measure. It usually affects one-tap cleanup; it doesn't grant system-level protection from being stopped. Force stops, low memory, manufacturer cleanup policies, and system updates can still end a process. An exemption also can't restore a node that has stopped working.

Always-on VPN: Verify the connection before enabling lockdown

On stock Android, go to Settings → Network & internet → VPN, then tap the gear icon next to the client. On Samsung devices, the common path is Settings → Connections → More connection settings → VPN. If supported by both Android and the client, you'll see “Always-on VPN.” Android has offered this system feature since version 7.0, but not every client supports it, and manufacturers may move the setting.

When enabled, Android tries to keep the VPN running and start it after events such as a reboot. It doesn't select a subscription, fix a configuration, or ensure that a proxy node is online. The client must still be able to run in the background and have a working configuration. Whether it can connect before the first unlock also depends on the client and how it stores its configuration.

Start the service manually and confirm that both direct and proxied access work.
Turn on “Always-on VPN,” lock the screen, then unlock and check that the service is still running.
Test after a reboot. Once the device is unlocked, check whether the client has resumed; don't just confirm that the setting is still enabled.
Only then decide whether to enable “Block connections without VPN.” These are two separate settings.

This option may also interfere with captive portal sign-in on shared office or hotel Wi-Fi. Complete the network's sign-in process before restoring VPN lockdown. Work profiles and organization-managed devices may prevent you from changing VPN policies; contact your administrator if so.

VPN disconnects when the screen is off: Separate process, network, and configuration issues

Note when the disconnect happened, then unlock the device and open the client. Don't restart the service right away, or you may lose evidence of the problem. Check three things: system VPN status, the client's service switch, and logs from the same period. If the client can export logs, remove subscription URLs, tokens, server addresses, and account details before sharing them.

What you see	Check first	Next step
VPN status is gone and the service switch is off	Background restrictions, another VPN taking over, or an app crash.	Check battery settings and exit records, then restart the service and test again.
VPN is still connected, but proxy traffic fails	Selected node, policy group, or a connection that didn't recover after a network change.	Switch to a known-working node and compare direct and proxied requests.
Works with the screen on, fails after switching to mobile data	Background data restrictions, network access, or an old connection that hasn't recovered.	Check mobile data permission, reconnect, and review the logs.
Only one app can't connect	Per-app proxy exclusions, that app's background permissions, or a matching rule.	Check whether the app is excluded, then inspect how its traffic is routed.

If the logs show i/o timeout, an operation timed out; this alone doesn't prove that Android stopped the app. For no such host, check DNS resolution first. For connection refused, check the destination port and service status. Use the app's exit status, error timestamps, and network conditions together to decide what to investigate.

TUN on Android clients is a virtual network interface for receiving IP packets; the implementation varies by client. It isn't a battery optimization permission. Don't change TUN, DNS, or rule settings at random to fix disconnects when the screen is off. Address system background restrictions first, then use connection logs to guide configuration changes. Change one setting at a time.

Background data and screen-off testing: Follow a consistent test plan

Go to App info → “Mobile data & Wi-Fi” or “Data usage” and make sure background data is allowed. If Data Saver is on, also check whether the client is allowed unrestricted data usage. This mainly affects mobile networks and doesn't replace the battery settings above.

Android Doze limits some background activity when a device has been idle for an extended period. Setting an app to unrestricted can reduce some of these effects, but it doesn't remove all limits on network access, wake-ups, or task scheduling. The durations below are suggested test windows, not universal disconnect thresholds or measured results.

Screen-on baseline, 2 minutes: Stay on Wi-Fi, confirm that both test sites load, and note the current node, rule mode, and start time.
Short screen-off test, 10 minutes: Don't switch networks. After unlocking, check VPN status before sending a new request. A page that was already open doesn't prove that a new connection works.
Extended idle test, 30 minutes: Unplug the device and leave it undisturbed. If the connection fails, note whether the service stopped and when the relevant log entries appeared.
Network switch: Switch from Wi-Fi to mobile data, wait about 30 seconds, then load a new page. Existing TCP connections may break when the IP address changes, so check whether a new request succeeds.
Reboot test: Test only after enabling Always-on VPN. Once unlocked, check whether the service resumes and confirm that internet access works.

Record six details: “Android version, client version, battery setting, screen-off duration, network type, and service status.” Find the client version on its About page and the Android version under Settings → About phone. Repeating the same test twice under identical conditions makes issues easier to isolate than changing several settings at once.

Common questions and settings after updates

Is it normal for Android to ask for VPN approval every time I start the client?

You may need to approve it again after switching VPNs, reinstalling the client, or changing its app identity. Android VPN approval isn't a regular toggle in the app permissions list. If the prompt appears every time without any of these changes, note your Android and client versions and check whether another app using VpnService is repeatedly taking over the connection.

Why does the client still stop after I set battery usage to unrestricted?

Check whether you tapped “Force stop,” a cleaner app ended the process, or the client crashed. After you tap “Force stop” in App info, you generally need to reopen the app manually. A battery optimization exemption can't undo a force stop or fix a software bug.

Do I need to change these settings after an update or when switching clients?

Android usually keeps existing settings when you update the same app. After uninstalling and reinstalling, or switching to a client with a different package name, check VPN permission, battery, notifications, and background data again. Before migrating, keep track of your configuration source and any local changes. Subscription links are credentials; don't include them in public reports or screenshots.

Keep only the settings you need: for manual daily use, start with VPN approval and background access. Enable Always-on VPN if you need the connection restored after a reboot. Turn on “Block connections without VPN” only if you're willing to lose internet access whenever the VPN drops. For installation and setup steps, see the setup guide. Reinstalling repeatedly isn't a useful way to troubleshoot background issues.