Set Up a Persistent WireGuard VPN on Android with Auto‑Connect (No Root)
18 min read Learn how to install WireGuard on Android, configure a VPN profile, and make it automatically reconnect on device boot using built‑in settings and Tasker, all without rooting. October 02, 2026 02:00
Before you start
Gather the following items before you begin. Having everything ready saves time and prevents interruptions mid‑procedure.
- Android device running Android 6.0 (Marshmallow) or newer. WireGuard requires at least API 21, but the auto‑connect tricks work best on Android 8.0+.
- Active internet connection (Wi‑Fi is preferred to avoid mobile‑data charges during testing).
- WireGuard app from the Google Play Store – it’s free, open‑source, and officially maintained.
- VPN configuration file (.conf) from your WireGuard server or a provider that supports WireGuard.
- Optional but highly recommended: Tasker (paid) for a UI‑free auto‑connect on devices that lack the built‑in "Always‑on VPN" option.
- Optional: a computer with
adbinstalled if you prefer the ADB method for auto‑start.
Safety tip: Changing VPN settings does not affect your personal data, but enabling "Always‑on VPN" will block all network traffic when the tunnel fails. Keep a backup of your original network settings in case you need to revert.
What we will achieve
After completing this tutorial you will have a fully functional WireGuard tunnel that:
- Connects automatically after a device reboot.
- Remains active in the background, protecting all apps (or only selected ones, depending on your choice).
- Works without root access, using only the official WireGuard client and standard Android features.
We’ll cover two complementary approaches for auto‑connect:
- Using Android’s native "Always‑on VPN" (available on Android 9+).
- Using Tasker (or ADB) to trigger the WireGuard app on older Android versions.
Step 1 – Install the WireGuard app
- Open the Google Play Store.
- Search for
WireGuard(developer: WireGuard LLC). - Tap Install. The download size is under 5 MB.
- Once installed, open the app. You may be asked to allow the app to create a VPN connection – tap Allow.
Why this matters: The official app includes the kernel module (via the Android VPN Service API) and a simple UI for importing configuration files. Using the official client guarantees compatibility with future Android updates.
Step 2 – Import or create a WireGuard tunnel
- In the WireGuard main screen, tap the + button in the lower‑right corner.
- Select Import from file or archive… if you already have a
.conffile.- Navigate to the folder where the file is stored (usually
Downloads/). - Select the file. The app parses the configuration and creates a tunnel named after the
Interfacesection.
- Navigate to the folder where the file is stored (usually
- Alternatively, choose Create from scratch… and fill in the fields:
- Interface → Private Key: generate inside the app or paste one from your server.
- Address: the VPN‑assigned IP (e.g.,
10.0.0.2/24). - DNS: optional, but setting a private DNS (e.g.,
1.1.1.1) prevents DNS leaks. - Peers → Public Key: copy from your server’s
[Peer]section. - Endpoint:
your.server.com:51820(replace with your server address). - Allowed IPs:
0.0.0.0/0, ::/0to route all traffic through the tunnel.
- Tap Save. The tunnel now appears in the main list.
Tip: If you use a commercial VPN provider, they often supply a QR code. The WireGuard app can scan it via Import from QR code…, which saves manual entry errors.
Step 3 – Test the connection manually
- In the WireGuard list, toggle the switch next to your tunnel to On.
- A system dialog will appear: "WireGuard wants to set up a VPN connection" – tap OK.
- Wait a few seconds. The tunnel status changes to Active and shows the data transmitted.
- Open a web browser and visit
https://ipleak.netorhttps://dnsleaktest.comto confirm that your public IP matches the WireGuard server and that DNS queries are resolved by the DNS you set.
If the tunnel fails to activate, note the error message (e.g., "Invalid key" or "Network unreachable") – you’ll find troubleshooting steps later.
Step 4 – Use Android’s native "Always‑on VPN" (Android 9+)
Android 9 (Pie) introduced a built‑in option that forces a selected VPN to stay connected at all times, even after a reboot. This is the simplest way to achieve persistence.
- Open Settings → Network & internet → VPN.
- On some OEM skins the path may be Settings → Connections → VPN or More connections.
- You will see a list of installed VPN apps. Find WireGuard and tap the gear icon next to it.
- Enable Always‑on VPN. A warning appears stating that "All network traffic will be blocked when the VPN is disconnected" – acknowledge it.
- Optionally enable Block connections without VPN to enforce the tunnel for every app.
- Reboot your device to verify that the tunnel starts automatically. After the boot, open WireGuard – the tunnel should show as Active without manual toggling.
Why it works: Android treats the selected app as the system VPN provider. The OS launches the app’s VPN service during the boot sequence, ensuring the tunnel is up before any other network traffic is allowed.
Step 5 – Auto‑connect on devices that lack "Always‑on VPN" (Android 8 and below)
Older Android versions do not expose the "Always‑on" toggle. We can achieve similar behaviour with a lightweight automation tool (Tasker) or a one‑time ADB command that adds the app to the system's "VPN always on" list.
Method 5A – Using Tasker (recommended for most users)
- Install Tasker from the Play Store.
- Open Tasker and grant the required permissions (Accessibility, Notification Access, etc.).
- Create a new Profile by tapping the
+button → Event → System → Device Boot. - Tasker will prompt to add a Task**. Name it
Start WireGuardand tap the checkmark.In the task editor, tap+→ App → Launch App.- Select WireGuard from the list.
- Immediately after the Launch App action, add another action:
Wait→ Time →2 seconds. This gives the app time to initialize. - Add a final action:
AutoInput Action(requires the AutoInput plugin) to tap the toggle switch for your tunnel. If you prefer a pure‑Tasker solution, use theSecure Settingsplugin to toggle the VPN service directly. - Save the task. The profile now reads: Device Boot → Start WireGuard → Wait → Toggle Tunnel.
- Reboot the phone. After the boot sequence, Tasker will automatically open WireGuard and enable the tunnel. You can verify by opening WireGuard – the tunnel should already be Active.
Note: Tasker’s UI automation may break if the WireGuard app UI changes. In that case, re‑record the AutoInput action or switch to the ADB method below.
Method 5B – Using ADB to set "Always‑on VPN" on older Android versions
ADB can write the same system setting that Android 9+ exposes in the UI. This method works on Android 5.0+ as long as the device allows the WRITE_SECURE_SETTINGS permission, which is granted to ADB by default on debug builds.
- Enable Developer options on your phone: Settings → About phone → tap Build number seven times.
- Enter Developer options and enable USB debugging.
- Connect the phone to a PC with
adbinstalled. Verify the connection withadb devices. - Find the package name of WireGuard. It is
com.wireguard.android. (You can confirm withadb shell pm list packages | grep wireguard.) - Run the following command to set WireGuard as the always‑on VPN:
adb shell settings put global vpn_lockdown_package com.wireguard.android - Reboot the device. After the boot, Android will automatically start WireGuard and bring the first configured tunnel online.
- If you have multiple tunnels and want a specific one, edit the WireGuard configuration file to set
PersistentKeepalive = 25for the desired peer – this forces the tunnel to stay alive even when idle.
Warning: The vpn_lockdown_package setting forces the VPN for all traffic. If the tunnel cannot be established (e.g., server down), you will lose network access until you clear the setting with:
adb shell settings delete global vpn_lockdown_packageStep 6 – Verify persistence across reboots
After you have applied either Method 4 (Always‑on VPN) or Method 5 (Tasker/ADB), perform a quick sanity check:
- Power off the device completely.
- Turn it back on.
- Wait for the lock screen to appear, then swipe up to the home screen.
- If you used the native Always‑on option, the WireGuard icon in the status bar should show a small key symbol, indicating an active VPN.
- If you used Tasker, you may see the WireGuard app flash briefly before the tunnel turns green.
- Open a browser and visit
https://ifconfig.me– the IP should be that of your WireGuard server.
Success! Your VPN now survives reboots without any manual intervention.
Troubleshooting common issues
| Symptom | Possible cause | Fix |
|---|---|---|
| WireGuard fails to start after boot | Tasker profile not triggered (Battery optimization killed Tasker) | Disable battery optimizations for Tasker: Settings → Apps → Tasker → Battery → "Allow background activity". |
| "VPN not connected" toast appears | Incorrect endpoint or server down | Check server reachability with a ping from another device, then update the Endpoint field. |
| All traffic blocked after reboot | Always‑on VPN enabled but tunnel fails to negotiate | Temporarily disable "Block connections without VPN" in Settings → VPN, then fix the tunnel configuration. |
| ADB command returns "Security exception" | Device is not in debug mode or USB debugging is off | Re‑enable USB debugging and re‑authorize the PC when prompted. |
If none of the above resolves the problem, consider resetting the WireGuard app data (Settings → Apps → WireGuard → Storage → Clear data) and re‑import the configuration.
Advanced optional tweaks
- Selective routing: Instead of
0.0.0.0/0, list only the subnets you want to protect (e.g., corporate LAN). This reduces latency for regular browsing. - Keepalive interval: Adding
PersistentKeepalive = 25to the peer section keeps the tunnel alive behind NAT firewalls. - DNS over TLS: Pair WireGuard with a DNS‑over‑TLS resolver (e.g.,
1.1.1.1on port 853) for extra privacy. - Battery optimization: Some manufacturers aggressively kill background VPN services. Add WireGuard to the device’s "Protected apps" or "Battery whitelist".
Safety and privacy considerations
While WireGuard itself is designed for security, the overall privacy of your connection depends on the server you use. Always trust the server operator, and avoid free public servers that may log traffic. If you are using a corporate server, follow your organization’s policy regarding DNS and split‑tunneling.
Enabling "Always‑on VPN" or the ADB lockdown setting forces all traffic through the tunnel. If the tunnel drops, you may lose connectivity entirely. Keep a backup method (e.g., mobile data) handy when testing new configurations.
Wrap‑up
By following the steps above you now have a WireGuard VPN that starts automatically every time your Android device boots, without needing root access. The native Always‑on option offers the cleanest solution on newer Android versions, while Tasker or ADB fill the gap on older devices. Remember to test after each change, keep your configuration files backed up, and monitor the tunnel’s health periodically.
Enjoy a consistently encrypted connection, whether you are on public Wi‑Fi, traveling abroad, or simply want to keep your browsing private.
User Comments (0)
Popular Apps
Games
Entertainment
Communication
E-mail
Security
Tools
Media
Internet
Finance
Design
Education
Android Firmwares
Travel & Local
Android
Windows
Linux