Set Up a Persistent OpenVPN Connection on Android (No Root)

Many Android users need a reliable VPN that stays connected even when the device switches between Wi‑Fi and mobile data. Android’s built‑in Always‑on VPN feature can keep an OpenVPN tunnel alive, but the steps are scattered across the OpenVPN client and the system settings. This tutorial walks you through the entire workflow – from preparing the OpenVPN profile to configuring the OS so the VPN auto‑connects and stays up without any root modifications.

Before you start

• VPN provider or self‑hosted server: You need an .ovpn configuration file and, if required, a username/password or client certificate.
• Android 9 (Pie) or newer – the always‑on VPN API is stable from Android 9 onward.
• Device should be charged above 30 % and connected to a stable Wi‑Fi network for the initial setup.
• Make a quick backup of important data (e.g., via Google Drive) – the steps do not touch user data, but it’s a good habit.

Step 1 – Install OpenVPN Connect

Why this matters: OpenVPN Connect is the only client that integrates cleanly with Android’s always‑on VPN flag. Third‑party clients may work, but they often lack the required system hook.

Step 2 – Prepare your OpenVPN profile

Tip: Keep the profile in a dedicated folder (e.g., /Download/OpenVPN) so you can locate it easily later.

Step 3 – Import the profile into OpenVPN Connect

What you should see: A connection log appears, ending with Initialization Sequence Completed. The status bar shows the OpenVPN icon, confirming an active tunnel.

Step 4 – Enable Android’s Always‑On VPN

Android can force a specific VPN app to start automatically after boot and prevent other apps from bypassing it. Follow these steps:

Why this matters: After a reboot, Android will automatically launch OpenVPN Connect and try to reconnect using the last used profile. The lockdown option guarantees that no app can slip out of the tunnel, which is essential for privacy‑focused users.

Step 5 – Verify auto‑connect behavior

1. Power off the device completely.
2. Turn it back on. Watch the status bar – the OpenVPN icon should appear within a minute.
3. Pull down the notification shade and tap the OpenVPN notification to view the connection log. It should show a fresh Initialization Sequence Completed line.
4. Open a browser and visit https://ipleak.net (or any IP‑checking site). Verify that the displayed IP belongs to your VPN server.

If the VPN does not start automatically, double‑check that the profile you imported is the “default” one (the most recent connection is remembered by the system).

Step 6 – Fine‑tune DNS to avoid leaks

Even with always‑on VPN, Android may still use the network’s DNS servers for queries that happen before the tunnel is fully up. To enforce VPN‑provided DNS:

After reconnection, repeat the IP‑leak test and look for the DNS resolver belonging to the VPN.

Step 7 – Reduce battery impact

Keeping a VPN alive 24/7 can drain the battery, especially on older devices. Consider these optimisations:

• Use UDP instead of TCP in the .ovpn file (change proto tcp to proto udp). UDP is lighter and maintains the tunnel with fewer retransmissions.
• Enable compression only if the server supports it – it reduces payload size.
• In Android Settings, disable Battery optimisation for OpenVPN Connect: Settings → Battery → Battery optimisation → All apps → OpenVPN Connect → Don’t optimise. This prevents the OS from throttling the VPN process.
• If you rarely need the VPN, you can disable the always‑on flag and manually toggle the connection when required.

Troubleshooting common issues

1. Connection fails with TLS handshake failed

• Check the system date and time – an incorrect clock breaks certificate validation.
• Verify that the server’s certificate is still valid (not expired).
• If you use a self‑signed CA, make sure the ca directive in the .ovpn file points to the correct .crt file.

2. DNS leaks despite always‑on VPN

• Confirm that Block connections without VPN is enabled – it forces DNS through the tunnel.
• Some OEM skins (e.g., Xiaomi, OnePlus) have aggressive DNS caching. Reboot after enabling the setting.
• As a fallback, install a DNS‑over‑HTTPS app (e.g., Intra) and set it to use the VPN’s DNS.

3. Android shows “VPN not connected” after a reboot

• OpenVPN Connect may have been killed by a battery‑optimisation policy. Disable optimisation as described in Step 7.
• Some devices require a manual “Allow always‑on VPN” permission for the app. Go to Settings → Apps → OpenVPN Connect → Permissions and enable Modify system settings if present.

4. “Block connections without VPN” prevents Wi‑Fi connectivity

• If the VPN server is unreachable (e.g., network outage), Android will block all traffic. Temporarily disable the lockdown mode or keep a secondary Wi‑Fi network without VPN for emergencies.

Alternative method: Using the built‑in Android VPN client

If you prefer not to install a third‑party app, Android’s native VPNService can import an .ovpn file via the OpenVPN for Android client (by Arne Schwabe). The steps are identical, except the app’s UI differs. The always‑on flag works the same way because it is a system setting, not an app‑specific feature.

Wrapping up

By following the steps above you now have a persistent OpenVPN tunnel that automatically starts after boot, blocks traffic when the VPN drops, and respects your privacy with enforced DNS routing. The configuration is fully reversible – simply toggle the always‑on setting off or uninstall OpenVPN Connect.

Remember to keep your .ovpn file up to date whenever your provider changes server keys or authentication methods. Regularly test the connection after Android updates, as OEM customisations sometimes reset VPN permissions.