Setup
VPN Not Working on Android? Start with the Android 16 Bug Google Has Not Fixed (2026)
Android troubleshooting articles almost all begin with “clear the cache”. On Android 16 that advice is worse than useless, because the most likely cause of a VPN that stops passing traffic is a fault in the operating system itself — one that Mullvad reported in August 2025 and that Proton, TunnelBear and the WireGuard app have since confirmed. Rule that in or out first; everything else is quicker to check afterwards.
The Android 16 always-on fault, and how to recognise it
The signature is specific. The VPN app still says connected. The key icon is still in the status bar. Nothing reaches the internet. There is no error, no notification, no reconnect attempt — from the app's point of view everything is fine, and from the kernel's point of view the routes and firewall rules no longer agree with each other.
- It shows up most reliably when the VPN app updates while the tunnel is running — which, with automatic updates, happens overnight while you are asleep.
- It is much more likely with always-on VPN enabled, and more likely still with “block connections without VPN” alongside it.
- It affects apps built on the platform VPN service generally, which is why unrelated providers reported the same thing within weeks of each other.
- There is no patch as of August 2026. Google has acknowledged the reports; no timeline has been given.
- 1Turn always-on VPN off (Settings → Network & internet → VPN → the gear next to your app), then reconnect manually. If traffic starts moving, you have found it.
- 2If that does not clear it, reboot. A reboot rebuilds the routing and firewall state that has drifted.
- 3Still stuck: force-stop the VPN app, clear its storage, reconnect, and re-enable always-on afterwards rather than before.
- 4As a habit, turn off automatic updates for the VPN app and update it deliberately, with the tunnel disconnected.
“Private DNS server cannot be accessed”
Android's Private DNS setting sends every lookup over TLS to a hostname you configure, and it operates independently of the VPN. When both are on, they compete: the VPN wants name resolution inside the tunnel, Private DNS wants it sent to its own server, and on networks that block DNS-over-TLS the result is the error above with the internet apparently working everywhere else.
- 1Settings → Network & internet → Private DNS.
- 2Set it to Automatic, or Off while you are testing. Do not leave a specific hostname configured while diagnosing a tunnel.
- 3Reconnect the VPN and re-test. If this fixed it, decide deliberately which of the two you want doing your resolution — a good VPN already resolves inside the tunnel, which is the same benefit.
The related failure is subtler: resolution works, but through the wrong server, so the tunnel carries your packets while your queries go elsewhere. That is a DNS leak, and it is invisible unless you test for it.
The tunnel dies when the screen goes off
This one is misreported constantly as “the VPN is unstable”. It is not unstable — it is being killed. Android's power management suspends background work aggressively, and manufacturer layers on Xiaomi, Samsung, Oppo, Huawei and OnePlus are considerably more aggressive than stock Android. The tunnel drops minutes after the screen locks and reconnects when you unlock, which makes it look intermittent.
- 1Settings → Apps → your VPN app → Battery → Unrestricted.
- 2On Xiaomi and Redmi, also open Security → Permissions → Autostart and enable it, then lock the app in the recents screen.
- 3On Samsung, remove the app from Settings → Battery → Background usage limits → Sleeping apps and Deep sleeping apps.
- 4Turn off any “adaptive battery” learning for this app if the manufacturer exposes it separately.
Always-on and “block connections without VPN”
These two switches are frequently confused. Always-on asks Android to keep the tunnel connected and re-establish it after reboots. Block connections without VPN is a kill switch: no application may use the network at all unless the tunnel is up. The second one, combined with the Android 16 fault above, produces a phone with no working internet and no explanation on screen.
It also breaks captive portals completely. Hotel, airport and café Wi-Fi holds you at a sign-in page, and with blocking on, that page cannot load either — so you cannot accept the terms, so you never get online. Disconnect, sign in, reconnect. The general shape of this trade-off is covered in what a kill switch actually protects.
Some apps work and others do not
That is per-app routing, and it is usually deliberate — either yours or the app's. Check your VPN client's split tunnelling list first: an app excluded from the tunnel behaves exactly like an app that “does not work with the VPN”, because it is not using it. The reasoning behind which apps belong on that list is in split tunnelling.
Banking apps are a category of their own. Many of them refuse to run when they see a datacenter address, and no configuration on your side changes their mind — the address you are borrowing has a reputation, and it is not yours. That mechanism, and why the same address makes captchas multiply, is explained in IP reputation.
Mobile data works, Wi-Fi does not — or the other way round
This split is the fastest diagnosis available on a phone, because you carry both networks in your pocket. If the tunnel comes up on mobile data and not on Wi-Fi, the router or the network is filtering it: many home routers ship with a “VPN passthrough” toggle, and public networks routinely pass TCP 443 and drop UDP wholesale. If it comes up on Wi-Fi and not on mobile data, the carrier is doing the filtering, and that is a different problem with a different answer — a transport that looks like ordinary web traffic rather than one that announces itself.
The reason UDP is the usual casualty, and what that means for protocol choice, is covered in why QUIC and UDP get blocked.
Frequently asked
Why does my VPN keep disconnecting on Android?
Two causes account for nearly all of it. Battery optimisation suspends the app when the screen goes off, which looks like an unstable connection but is the system killing it — set the app to Unrestricted battery use. The second is the Android 16 always-on fault, which drops the tunnel silently, most often after the app updates itself while running.
What does “Private DNS server cannot be accessed” mean?
Android is trying to send DNS queries over TLS to the hostname you configured, and cannot reach it — often because the current network blocks DNS-over-TLS, or because your VPN is already handling resolution and the two are competing. Set Private DNS to Automatic and reconnect.
Is the Android 16 VPN bug fixed?
Not as of August 2026. It was first reported publicly by Mullvad in August 2025 and has since been confirmed by other VPN developers. Google has acknowledged it through its issue tracker without publishing a timeline. The workarounds are turning always-on off and on, rebooting, and not letting the VPN app update while the tunnel is running.
Should I turn on “block connections without VPN”?
Only if you understand what it costs. It genuinely prevents traffic escaping when the tunnel drops, which is the point of a kill switch. It also makes captive portals impossible to sign in to, and on Android 16 it turns a silent tunnel failure into a phone with no internet and nothing on screen to explain it.
Why does the VPN work on Wi-Fi but not on mobile data?
The carrier is filtering the protocol. Mobile networks are noticeably more aggressive than home ISPs about UDP-based tunnels, and they can throttle or drop them without any error being shown. Protocols that carry traffic inside an ordinary TLS session on port 443 are far harder to single out, which is why they exist.
Did this help?
Nothing follows from the answer; only we see it.