The whole Android VPN process comes down to five steps: install the client, import your subscription, approve the connection, whitelist the app from battery optimization, and verify the exit. Sounds simple, but Android vendors wedge at least three permission dialogs into those five steps — dismiss any one of them and you'll later see "connected but no internet" or "drops five minutes after the screen locks." The sections below take them in order; if you're stuck, jump straight to the relevant one.
Before You Start: Three Things to Confirm
Before you download anything, spend a minute confirming the three points below. These decide whether the rest of the process goes smoothly or wastes your time:
- System version: Android 7.0 or later. On older devices, the TLS libraries modern clients depend on and the VPNService interface don't behave consistently, so it's best not to continue.
- Free storage: the client itself is usually 30–80MB, plus route config cache, so leaving 200MB free is a safe margin.
- Subscription link: copy it from your VPNFN dashboard — a single string that looks like
https://…/cobalt-hub/client/subscribe?token=…. This link is your account credential; don't post it in group chats or share it as a screenshot.
Never Type the Subscription Link by Hand
The token in the link is a case-sensitive random string, and typing it by hand will almost certainly go wrong. Use the "Copy" button in the dashboard, or send the link to your own notes app and long-press to copy. If a platform wraps the link onto two lines, make sure you've copied the whole thing.
Step 1: Install the Client
There are two ways to get the Android client; prefer the first:
- On the VPNFN dashboard's download page, choose Android and download the APK. The browser will warn that "this type of file can harm your device" — that's the standard Android warning for any APK from outside the store. Choose "Download anyway."
- Once the download finishes, tap the file in the notification shade. The system will say "for your security, your phone is not allowed to install unknown apps." Tap "Settings" in that dialog, turn on "Allow from this source" for the browser (or file manager) in question, then go back and continue the install.
Don't rush to open the app after installing. First long-press its icon in the app list and confirm that the package name shown under "App info" matches the source you downloaded from, then move on.
Why Not to Use the Built-in VPN Settings
Android's system settings include a "Network & internet → VPN" entry where you can manually configure PPTP, L2TP/IPSec and similar types. It's not the route to take: the system only supports older protocols that handshake slowly and are easy to fingerprint, and there's no split routing, so every bit of traffic — including your local banking and food-delivery apps — goes out through the tunnel. Modern protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC have to be implemented by the client itself; the native settings can't configure them.
Step 2: Import the Subscription Link
Open the client. On first launch it usually lands straight on the "Add subscription" or "Subscriptions" screen. The path is:
- Tap the "+" at the bottom right or the top, then choose "Import from clipboard" or "Add subscription."
- Long-press inside the "Subscription URL" field to paste the link you copied. The name is up to you — "Primary routes", say — and just helps you tell subscriptions apart later.
- Tap "OK" or "Save". The client will trigger a subscription update and pull down the route list behind the link.
- When the route list appears (usually grouped by region — Japan, Singapore, United States), the import worked. If the list is empty, check your network first, then check that the link is complete.
| What You See After Importing | Common cause | What to do |
|---|---|---|
| "Subscription parse failed" | The link is incomplete, or a space got mixed in when copying | Copy it again from the dashboard and clear the input field before pasting |
| "Connection timed out" | Your current network can't reach the subscription server | Retry on Wi-Fi or mobile data, or switch the subscription domain in the dashboard |
| Routes are listed but every latency test times out | The subscription has expired, or the device clock is off | Turn on "Set date and time automatically" in system settings, then update the subscription again |
| You have to re-import it every time you open the app | The system cleared the client's data | See the battery whitelist setup in section five |
Step 3: Grant the VPN Connection Permission
Select a route and tap the connect button. Android now shows a system-level dialog titled "Connection request", saying something like "an app wants to set up a VPN connection that allows it to monitor network traffic." This dialog is drawn by the system; the client can't skip it or change its wording.
After you tap "OK", a key-shaped icon appears in the status bar (some vendor builds show the letters VPN instead), meaning the tunnel is up. To disconnect, go back to the client and tap disconnect once, or disconnect straight from the system notification.
About the phrase "monitor network traffic"
This is Android's fixed wording for the VPNService interface — every VPN app shows the same sentence, and it doesn't mean the client is reading your content. VPNFN's logging policy is not to record browsing content or access history; only the connection-state data needed for troubleshooting is kept. What's genuinely worth watching is this: install the client only from official channels, and never download "modified" builds of unknown origin from third-party forums.
Step 4: Whitelist the Client from Battery Optimization
This is the step Android users skip most often, and the one most likely to cause "it just drops after a while." Vendor battery policies freeze background processes once the screen goes off; when the VPN's foreground service is frozen, the system tears down the tunnel.
The general path is "Settings → Apps → VPNFN client → Battery" and set the policy to "Unrestricted". Some systems differ:
- Stock Android / Pixel: Settings → Apps → [app] → Battery → Unrestricted.
- Xiaomi / Redmi (MIUI, HyperOS): Settings → Apps → Manage apps → [app] → Battery saver → No restrictions; also turn on "Autostart" under "Other permissions".
- Huawei / Honor: Settings → Apps → App launch → turn off "Manage automatically" and manually tick "Auto-launch", "Secondary launch" and "Run in background".
- OPPO / OnePlus / realme: Settings → Battery → App battery management → [app] → Allow background running.
- vivo / iQOO: Settings → Battery → High background power consumption → allow the app to keep running in the background.
- Samsung: Settings → Battery and device care → Battery → Background usage limits → add the app to "Never sleeping apps".
If your system also offers "lock background tasks" (pull down on the app card in the recents view until a padlock icon appears), turn that on too — it noticeably cuts the odds of the app being killed.
Step 5: Verify the Exit Is Really Working
Plenty of people see the key icon in the status bar and call it done, but the key only means the tunnel exists — not that traffic is going through it. Run these three checks:
- Check the exit IP: before connecting, visit any IP lookup site in your browser and note the location it shows; after connecting, refresh it — the location should now match the region of the route you picked. If both results are the same, your traffic isn't going through the VPN.
- Check DNS: open a DNS leak test page in your browser and see whether the resolver's location matches your exit IP. If the exit says Japan but DNS still shows your local ISP, DNS queries are going out in the clear — set DNS to "remote resolution" in the client, or specify a public DNS server manually.
- Check real-world access: open a site that wouldn't load before and confirm it loads normally. This is the final check; if the first two pass and this one fails, the client's routing rules probably don't cover that app.
Split Routing: Which Traffic Should Use the VPN
Android clients generally offer three routing modes; picking the right one saves a lot of grief:
| Mode | Behavior | Best for |
|---|---|---|
| Global | All traffic goes through the tunnel | Temporary troubleshooting, or when you need everything encrypted |
| Rule / split | Decided by a built-in rule set: local traffic direct, overseas traffic through the proxy | Everyday use — a balance of speed and access |
| Direct | Builds the tunnel but forwards no traffic | Only for testing whether the subscription works |
In split mode, rule sets usually cover three kinds of entries: domain keywords, IP ranges and app package names. If an app isn't going through the proxy, first check whether the rule set classified it as direct — you can add it to the proxy list manually under "Bypass" or "Custom rules" in the client.
How Route Types Affect the Phone Experience
A single client's route list often mixes several types. The differences show up most on a phone, because phones hop between Wi-Fi and mobile data all day:
- IEPL dedicated routes: run on private channels with the least jitter at peak hours — the first choice for video calls and long sessions, and usually the priciest.
- Relay routes: pass through a relay node before heading overseas; latency is steadier than a direct connection, which suits everyday browsing and short-form video.
- Direct routes: connect straight to an overseas server; latency depends on your local network quality and swings more at peak hours, so they're best for temporary use.
Check the Status Again After Switching Networks
When you move from Wi-Fi to mobile data, the system rebuilds the network interface and the tunnel has to re-handshake. Most clients reconnect automatically, but a few systems fail silently. After switching networks, pull down the notification shade and confirm the key icon is still there.
Common Failures and the Order to Troubleshoot Them
When something goes wrong, work through the list below, starting with the most likely cause — don't just switch routes straight away:
- ✅ First confirm the subscription is still valid: trigger "Update subscription" manually in the client and see whether the route list refreshes.
- ✅ Confirm the system clock syncs automatically: a drift of more than a few minutes breaks the TLS handshake, which shows up as "connected but pages won't load."
- ✅ Confirm the battery whitelist is set: if it always drops when the screen locks and recovers when you wake it, this is almost certainly the cause.
- ✅ Confirm there's no conflict with another VPN or accelerator app: Android allows only one VPN tunnel at a time, and two apps will knock each other out.
- ✅ Try another network: if mobile data works and one particular Wi-Fi doesn't, the problem is the router or that network's policy, not the client.
- ❌ Don't hammer the connect button: repeated handshakes in a short window look anomalous to the server and you'll end up waiting longer.
- ❌ Don't clear the app's data casually: you'll lose the subscription, routing rules and whitelist settings and have to set everything up again.
A Few Questions Beginners Ask
Do I need overlay or accessibility permissions?
No. The client builds its tunnel through VPNService, which has nothing to do with overlay or accessibility permissions. If an app insists you enable accessibility before it will connect, check where it came from first.
Can I use it on my phone and computer at the same time?
Yes. VPNFN doesn't limit the number of devices — the same account can be signed in on a phone, tablet and computer at once, with no extra purchase. The subscription link itself can be imported into several clients, though it's easier to manage if you use the same link on every device.
Can I skip the client entirely?
Android's built-in VPN configuration screen only supports older protocols, can't use modern client protocols, and has no support for subscription links or split routing. For a stable experience on international routes, you still need to install a client.
Should I disconnect when I'm done?
It depends on your habits. Leaving it on saves you from connecting manually each time, and split mode won't slow down local apps; connecting only when needed saves a little battery. Both are reasonable — it comes down to how sensitive you are to battery life.
Summary
The barrier to using a VPN on Android isn't technical, it's system permissions. Handle all three dialogs — "allow unknown apps", "VPN connection request" and "unrestricted battery" — then verify once with the exit IP, DNS and real-access checks, and you're unlikely to run into trouble again. If you're stuck on a step, run through the troubleshooting table above first; if that doesn't solve it, contact support with the client version, system version and the exact error message, which saves a lot of back-and-forth.