Clash for Android Setup Guide: VPN permission, battery optimization & per-app proxy

Understand the three settings layers: VPN access, background operation, and proxy rules

Clash clients for Android typically use the system VpnService to create a local virtual network interface, then pass the traffic it receives to the core for processing. A VPN icon only tells you that the tunnel is in use; whether a node works and which requests use the proxy depend on your configuration and rules.

Clash for Android, FlClash, and other clients differ in interface and core versions, so menu paths from one app may not apply to another. This guide separates Android system settings from in-app settings. If labels differ, look for the relevant function rather than enabling extra options just to match a screenshot.

For the initial setup, follow this order: import and enable a configuration → grant VPN permission → verify connectivity with the screen on → adjust background permissions → configure per-app routing last. Change one type of setting at a time so you know what to undo if something breaks.

First connection: grant VPN access and check for conflicts

Approving the VPN permission prompt

1. Import a subscription or local configuration in the client, then make sure it's selected. A successful subscription download doesn't mean the configuration has been applied.
2. Tap Start, Connect, or the VPN toggle. The first time you connect, Android will usually show a connection request saying the app wants to set up a VPN connection.
3. Check the app name in the prompt to make sure it matches the client you just installed and opened, then tap OK. You don't need to grant device administrator access or install a root certificate.
4. Check the client's status and the connection details in the system status bar or VPN settings. Some Android versions hide the key icon, so check the system VPN page if needed.

VPN access and notification permission are separate. Android 13 and later may also ask for notification permission. Allowing notifications makes it easier to monitor a persistent service, but it doesn't grant VPN access. Likewise, a missing notification alone doesn't mean the connection has stopped.

If the connection drops right after starting, check for another VPN

Usually, only one VPN can be active for each Android user or profile. Ad blockers, firewalls, packet capture tools, work VPNs, and some network-acceleration apps can all occupy that slot. Stop the local VPN feature in other apps before starting Clash. Don't repeatedly tap Connect in two clients and make them compete for control.

On stock Android, check Settings → Network & internet → VPN. On Samsung One UI, try Settings → Connections → More connection settings → VPN. If the manufacturer has changed the menus, search for “VPN” in Settings and open the system result, not an app store listing.

• Always-on VPN: Enable this only after the client is running reliably. Leave it off while testing to prevent Android from automatically starting another client that's already bound to the VPN.
• Block connections without VPN: Your phone may lose internet access whenever the VPN is stopped or hasn't connected yet. Combined with per-app exclusions, this setting may also block excluded apps.
• Work profile: Your organization's management policies may restrict VPN creation. Check network settings separately in your work and personal profiles, and don't try to bypass organizational policies.

Battery optimization exemptions: adjust the app's battery settings before enabling auto-start

“Works with the screen on, then disconnects after a few minutes locked” is a typical sign to check background restrictions. If it can't connect even with the screen on, check your configuration, node, and DNS first. Turning off every battery-saving feature usually just increases battery drain; it won't fix a bad configuration.

Where to find Android battery settings

Long-press the client icon and tap App info, then look for Battery or App battery usage. Some Android 13 and 14 devices offer Unrestricted, Optimized, or Restricted modes, or an Allow background usage toggle. Start by allowing background activity, then test with the screen off. Labels vary by Android version and manufacturer.

On older stock Android versions, go to Settings → Apps & notifications → Special app access → Battery optimization. Switch the list to All apps, find the client, and select Don't optimize. If the app isn't listed, check whether the list is showing only apps that aren't optimized.

These are common settings paths, not universal instructions for every device. If you can't find a setting, search Android Settings for “battery optimization,” “background activity,” or “auto-start.” On Huawei devices, check whether the system supports the Android app you've installed. Steps for an Android APK don't necessarily apply to native HarmonyOS apps.

Auto-start and locking an app in Recents are separate settings

• Allow auto-start: Reduces the chance that Android blocks the app after a restart or service recovery. The client must also support and enable launch at startup; this permission doesn't add that feature by itself.
• Lock in Recents: Some manufacturers let you lock an app from its card in the Recents menu. This mainly helps prevent accidental closure when you tap Clear all; it doesn't replace battery settings.
• Force stop: After you force-stop an app from App info, it may remain stopped until you open it manually. Don't mistake the fact that it won't restart automatically after a force stop for a broken battery optimization exemption.

Doze, Battery Saver, and manufacturer background management are different layers of restrictions. Exempting an app from battery optimization doesn't guarantee an uninterrupted connection; memory pressure, system updates, and network changes can still interrupt the service. Grant these permissions only to clients that need to run continuously—there's no need to loosen restrictions for other apps.

Per-app proxy: choose which apps to route, then check the rule mode

Android clients often use settings called Access control, Per-app proxy, or App filtering to decide which apps enter the VPN interface, based on their package names. This happens before traffic reaches the core and is separate from domain rules in your configuration. In Clash for Android, look for Access control. Other clients may place the equivalent setting under VPN, Network, or Per-app settings.

Include or exclude apps—choose the right direction

1. Proxy only selected apps: Use this when you want only a few apps, such as a browser or e-reader, to go through the client. Start by selecting one browser and testing it instead of managing dozens of apps right away.
2. Bypass selected apps: Use this when the client should handle traffic from most apps, with exceptions such as banking or device management apps. Excluded apps usually use the system network directly.
3. Save and reconnect: After changing the app list, stop and restart the VPN so the client can recreate its interface. Existing connections may still use the old route, so fully close and reopen the app you're testing, too.

For example, say you add only a browser to the include list and use rule mode. The browser can still connect directly to sites that match a direct rule, while a video app not on the list won't use this VPN route. When troubleshooting, check both whether the app is included and which rule its connection matches—one toggle doesn't tell the whole story.

System apps, cloned apps, and DNS: important limitations

• App cloning: A cloned app may run in a separate user profile. Even if its name looks identical, it may not share the original app's routing settings. Check which profile is running the client and target app.
• System components: Sign-in, the download manager, and Android System WebView may also handle requests. If routing only the main app isn't enough, use connection logs to identify what's involved instead of selecting every system app.
• Secure DNS in apps: A browser's encrypted DNS, Android Private DNS, and the client's DNS settings are separate. Per-app filtering can't guarantee that all lookups use the nameserver in your configuration.

If one browser works but another app doesn't, first check whether the app is included and whether you reconnected after changing the list. Then check rule matches and DNS. Don't start by switching the TUN stack; Android VPN routing and desktop system proxy settings work differently.

Test in order: with the screen on, while locked, and after switching networks

The steps below provide a repeatable test. The suggested wait times are observation windows, not battery-life results for any particular device. Keep the same configuration, node, and browser throughout to avoid mixing variables.

1. Screen on for 2 minutes: After connecting, open two sites you can normally access and check whether the client logs their connections. Confirm the rule results match what happens; a successful node latency test doesn't guarantee that a webpage will load.
2. Screen locked for 10 minutes: Leave the phone in its normal battery mode, lock the screen, and wait. Then unlock it and revisit the same sites. Note whether the VPN is still connected, whether it reconnected, and whether the logs show a service restart.
3. Switch networks once: Switch from Wi-Fi to mobile data, wait for the connection to come back, then open a new page. An existing TCP connection may drop without the app being killed in the background; check whether a new connection can be established.
4. Restart once: Test this only after enabling launch at startup. Restart and unlock the phone, then check whether the client resumes as expected. Also check any Always-on VPN settings at this point.

If you need to report an issue, note your Android version, device OS, client version, core version, and when the problem occurred. Hide subscription URLs, node credentials, and browsing history in screenshots; full subscription links often contain access tokens and shouldn't be posted publicly. For more connection troubleshooting, see the full guide.

FAQ: Why doesn't everything work as expected, even with permissions enabled?