Android Clash Setup: VpnService Permission and Battery Optimization

VpnService: Android’s Traffic Entry Point, Not a Remote Server

VpnService is Android’s VPN service API. Android Clash clients typically use it to create a local virtual network interface, send matching packets to the proxy core, and let rules decide whether to connect directly, proxy, or reject the traffic. It is not a subscription service, nor does it mean your traffic necessarily passes through a remote VPN server.

So, a VPN icon in the status bar only indicates that Android has a VPN connection. It does not confirm that your subscription is valid, a node is reachable, or that every app is routed through the proxy. Conversely, the VPN icon may remain visible when the policy is set to DIRECT, because the local traffic interface is still active.

• System permission: Allow the client to create a local VPN using VpnService.
• Configuration and core: Load nodes, proxy groups, DNS, and routing rules. Different clients may use different generations of the Clash or mihomo core.
• Background operation: Keep the service and core process running so the system does not restrict them when the screen is locked.

Troubleshoot these three layers separately. Reimporting a subscription will not revive a background service stopped by battery management. Repeatedly approving the VPN connection will not fix expired node credentials.

First Launch: Check VPN Permission and Notifications

Start with a Working Configuration

1. Install a client compatible with your Android version and processor architecture, then import your subscription or YAML file from the configuration screen.
2. Select the configuration and confirm that it parses successfully. Keep the provider’s DNS and routing rules unchanged at first, and avoid changing multiple settings at once.
3. Tap the client’s Start or Connect button. When Android displays a confirmation prompt such as “Connection request,” verify the requesting app’s name before allowing it.
4. Open Settings → Network & internet → VPN and check that the active connection belongs to the intended client. On some devices, this setting is under Connection & sharing or More connection settings.
5. Open an HTTPS page and check the client’s connection log for a new connection and the policy it matched.

VPN permission is not a standard camera or storage permission, so it usually won’t appear in the regular App permissions list. If you denied it, return to the client and start the connection again. If the confirmation button is unresponsive, close floating windows, screen filters, or other apps drawing over the system dialog, then try again. Do not use auto-clickers to bypass the confirmation.

Manage Notification and VPN Permissions Separately

Since Android 8.0, background execution limits have made foreground services an important way to keep long-running network tasks active. Android 13 added runtime notification permission. Denying it does not revoke VPN permission or necessarily prevent a foreground service from starting, but it can make the service less visible in the notification shade.

If the client requests notification permission, allow it and make sure its connection-status notification category is enabled. Notifications can help you tell whether the service is running, but a missing notification alone does not mean the VPN disconnected. Check the system VPN page and the client’s connection status too.

Battery Optimization: Battery Settings, Auto-Start, and Background Locking

“Add to the allowlist” is not a single, consistently named Android setting. System battery optimization, manufacturer background management, auto-start controls, and locking an app in recent tasks can each affect whether a service stays running. Change and record these settings one at a time so you know which one helps, rather than enabling everything at once.

First, go to Settings → Apps → the client → Battery or App battery usage, then select Unrestricted or allow background use. On older Android versions, you may need to go to Special app access → Battery optimization, switch to all apps, find the client, and select Don’t optimize.

This setting is not a free pass on battery life. Persistent connections, frequent speed tests, short health-check intervals, and many active connections can all increase battery drain. Use the allowlist to address background restrictions; there’s no need to set every proxy group’s health-check interval to a few seconds.

Common Device Settings: Find App Info, Then Check Background Restrictions

These are common paths, not exact instructions for every Android version. OS updates, regional firmware, and device models can change menu names. If you can’t find a setting, long-press the client icon and open App info, or search Settings for “battery optimization,” “auto-start,” or “background activity.”

Pixel and Near-Stock Android

• Go to Settings → Apps → See all apps → the client → App battery usage.
• If the options include Allow background usage and an optimization level, allow background use and set the relevant option to Unrestricted.
• If Data Saver is enabled, open a section such as the app’s Mobile data & Wi-Fi settings and check background data and unrestricted data usage.

Xiaomi, Redmi, HyperOS, and MIUI

• On the App info page, look for Battery saver. A common option is No restrictions.
• Look for Auto-start management or Background auto-start under Settings → Apps → App permissions or nearby, then allow the client to start automatically.
• If your recent apps screen supports locking, long-press the app card or open its menu to lock it. Gestures vary between launcher versions.

The lock icon in recent apps only affects some cleanup actions. If the connection still drops when the screen is locked, check the battery settings rather than repeatedly locking the app.

Huawei and HONOR: App Launch Management

On systems with this option, go to Settings → Apps & services → App launch, find the client, turn off Manage automatically, then allow Auto-launch, Secondary launch, and Run in background as needed. HONOR devices may place this setting under Apps. If your device does not support Android app installation, the APK and VpnService steps in this guide do not apply.

OPPO, OnePlus, and realme: Background Activity and Auto-Launch

From App info, open Power usage or Battery usage and check Allow background activity and Allow auto launch. Check the recent apps screen for a Lock option as well. Menu names vary across ColorOS, OxygenOS, and realme UI, so use the options available on your device.

vivo, iQOO, and Samsung

• vivo and iQOO: Go to Settings → Battery and look for Background power consumption management. Set the client to a mode that allows more background power use, and check auto-start permissions in system app management or iManager.
• Samsung: Go to Settings → Apps → the client → Battery and select Unrestricted. Then go to Battery → Background usage limits and check Sleeping apps and Deep sleeping apps. Make sure the client is not restricted; if available, add it to Never auto sleeping apps.

Disconnects After Screen Lock: Distinguish a Stopped Service from a Network Issue

“Works with the screen on, stops working when locked” describes a symptom, not necessarily a battery-management issue. Wi-Fi disconnections, mobile network switches, node timeouts, and DNS failures can all show up in the background. Use the steps below to reproduce the issue. The suggested intervals are for troubleshooting, not benchmark results.

1. Record a baseline: Stay on the same Wi-Fi network and note the client version, Android version, current policy, start time, and test URL. First confirm that the site loads while the app is in the foreground.
2. Lock briefly: Lock the screen for 5 minutes, then check whether the system still shows the VPN as connected and whether the client needs to be restarted.
3. Extend the test: Lock the screen again for 30 minutes under the same conditions and check again. Passing a short test does not rule out deep sleep issues.
4. Test network switching separately: While the service remains connected, turn off Wi-Fi and switch to mobile data. Check whether new connections recover. Keep this test separate from the screen-lock tests above.
5. Change one setting at a time: Adjust only one category of background setting per test, repeat the same steps, and record the result.

When exporting logs, you can temporarily set log-level: info and increase verbosity briefly only if needed to diagnose the issue. Logs and screenshots may contain subscription URLs, node servers, visited domains, or access tokens. Remove sensitive information before sharing them.

Always-On VPN and Per-App Proxy: Avoid Losing Access After Reconnecting

Always-On Does Not Guarantee the VPN Stays Up

Android 7.0 and later support always-on VPN, but the client must also support and allow the feature. Go to Settings → Network & internet → VPN, tap the settings icon beside the client, and look for Always-on VPN. If the option is unavailable, don’t try to enable it by changing unrelated settings.

Block connections without VPN is a separate restriction: Android may block connections not covered by an active VPN. If you enable it and the client configuration stops working, your phone may lose all internet access. First test normal connections, recovery after a restart, and per-app behavior before turning it on. For troubleshooting, temporarily disable the block to see whether it is causing the issue.

Per-App Lists and Rule Mode Work at Different Layers

In Android clients, options such as “Proxy selected apps only” or “Bypass selected apps” typically determine which apps enter the local VPN interface. mode: rule determines how connections that reach the core are matched against rules. If an app never enters the VPN, changing rule order usually won’t change its route.

Some clients call per-app settings “Access control.” With an allowlist, include every app that actually makes network requests. After changing the list, re-establish the VPN as prompted by the client. If Block connections without VPN is also enabled, excluded apps may be unable to connect instead of connecting directly.

Likewise, mixed-port: 7890 in a configuration is an example of a local HTTP/SOCKS proxy listening port, not an Android VPN permission switch. If you start only the local port without establishing a VPN, regular apps will not automatically send traffic to it just because the port is available.

Recovery Order: Restart the Service, Check the Network, Then Adjust the Configuration

• No VPN connection: Check permission, background restrictions, and other VPN apps, then restart the client service.
• VPN connected but no access: Confirm the local network works, then check the current node, DNS, and connection logs.
• Only some apps have problems: Check the per-app scope, matched policies, and Android’s VPN lockdown setting.
• Doesn’t reconnect after a reboot: Test the client’s connect-on-boot option, auto-start permission, and Android’s always-on VPN separately. They are not the same setting.

A reliable Android Clash setup depends on matching permissions, background operation, and configuration. Keep a known-good configuration, then reproduce the issue and change settings one at a time. This makes it easier to find the cause than changing the core, DNS, and battery settings all at once. For configuration fields, see the configuration reference. Before switching clients, check platform compatibility in the client comparison guide.