Always-on VPN and “Block connections without VPN”: what they are and how to turn them on

“Always-on VPN” and “Block connections without VPN” are two Android switches tucked away in the network settings. Below: what they do, how to turn them on, what their convenience costs and how to set them up for Mayak. Everything here is as of 10 October 2026.

What always-on VPN is

Normally a VPN app runs until you switch it off or the system stops it. “Always-on VPN” changes who is in charge: now Android itself is responsible for keeping the app running. Per the Android documentation, the system starts the chosen VPN app when the phone boots and keeps it running while the phone is on. The mode exists since Android 7.0.

An important caveat: the system keeps the app running, while the connection to the server remains the app's job. If the network drops, it is the app, not Android, that reconnects.

Only one VPN can be always-on: Android has a single VPN slot. If another app has “Always-on VPN” enabled, yours cannot come up — what that looks like and what to do.

“Block connections without VPN” is the kill switch

A kill switch is the general name for “no protection — no internet”: if the tunnel drops, traffic does not go out directly but waits. On Android it is the second switch on the same screen, “Block connections without VPN”. Per the  Android documentation, with it the system blocks any traffic that does not use the VPN, and when you turn it on, Settings warns that there will be no internet until the VPN connects.

Without the second switch the first one only keeps the app running: in the seconds it takes to reconnect, traffic may go out directly. Together they give what people usually mean by an “always-on VPN”.

How to turn on always-on VPN on Android

1. Connect once in the VPN app itself: the system needs you to have granted it permission already.
2. Open Settings → Network & internet → VPN.
3. Tap the settings icon (the gear) next to the app.
4. Turn on “Always-on VPN” and, if you want a kill switch, “Block connections without VPN”.

On Samsung, Xiaomi, Huawei and other brands the item lives in their own sections and is named slightly differently; the quickest way is to search settings for “VPN”. Brand paths are in the articles on Samsung and on Xiaomi and Redmi.

What always-on VPN costs you

• No VPN — no internet. With “Block connections without VPN” on, the phone stays offline until the tunnel comes up: after a reboot, when switching from Wi-Fi to mobile data, in a lift.
• Switch the app off — switch the internet off. Until the mode is removed on the same system screen, a switched-off VPN leaves the phone offline. How to get out of that — “How to  turn off a VPN without losing the network”.
• Apps outside the tunnel go offline. If the VPN app uses split tunneling, then per the Android documentation, with “Block connections without VPN” on, the excluded apps lose the  network. A bank you sent outside the tunnel, for example, will not open. We have not tested this combination on a phone ourselves.
• One slot for everyone. While the mode is on for one app, another VPN app will not come up.

How to turn on always-on VPN for Mayak

1. Connect in Mayak at least once.
2. Open Settings → the Protection group → “No protection — no internet”. The button opens the right Android system screen.
3. There, for Mayak Networks, turn on “Always-on VPN” and “Block connections without VPN”. If the screen does not open, the app shows the path so you can walk it by hand.
4. In the same Protection group turn on “Auto-connect”: after a reboot the app brings back the last working connection by itself.

If you use the “RU Apps” preset or your own split tunnel, remember the third cost above: apps in the preset may go offline while “Block connections without VPN” is on. Then choose one of  the two: that switch or the preset.

The VPN keeps switching itself off: does this mode help

“Always-on VPN” helps when the system itself stops the app: battery saving, memory cleaning, “smart” modes of the  vendor's skin. Then Android starts it again. But if the connection drops because of the network, say in the metro or when moving from Wi-Fi to mobile data, the mode will not hold it: the app reconnects by itself. Why a VPN disconnects and what else to check — the breakdown by cause.

What we checked

• How both modes work — from the Android developer documentation, 10 October 2026.
• Mayak's items “No protection — no internet”, “Auto-connect” and the hint for when the system screen does not open — from the code of version 1.0.0.
• The path in stock Android settings — from Google's help, checked on 24 September 2026 for the article on turning a VPN off.

What we do not know

• The combination with split tunneling on a real phone. We go by the Android documentation.
• The exact labels on every brand. Vendors rename and move items.
• iPhone. Whether Happ and INCY, through which Mayak works on iPhone, have a similar mode we have not checked.

Short answers

What does “always-on VPN” mean? Android itself starts the chosen VPN app at boot and keeps it running.

What is a kill switch in a VPN? “No protection — no internet”: traffic does not go out directly if  the tunnel drops. On Android it is the “Block connections without VPN” switch.

How do I turn on always-on VPN on Android? Settings → Network & internet → VPN → the settings icon next to the app → “Always-on VPN”.

Why did the internet disappear after I turned it on? “Block connections without VPN” is on, and the  tunnel is not up yet or the app is off. Connect, or turn that switch off on the same screen.

Why does it say the always-on VPN is disconnected? Usually the always-on app is not holding a tunnel right now: it was switched off, its access ran out, or there is no network. Open it and connect.

Does always-on VPN drain the battery? The mode itself does not; usage depends on the VPN app and how much traffic goes through it.

Can two VPNs be always-on? No: Android has one VPN slot.