A VPN for mobile data has to do three things you barely notice on home Wi-Fi: reconnect by itself when the phone changes network on the move, find another route by itself if the first one does not get through at the operator, and not waste data. Mobile data is not “broken” either: in our log 96 attempts out of 100 come up on it. Below: how it differs from Wi-Fi, what we measured at the operators, and what to switch on in the phone. Everything here is as of 4 October 2026.
In short. For mobile data, choose an app that has several routes to its server and tries them by itself: a route that works at home may not get through at the operator. In the phone, let the app run in the background and turn on always-on. A tunnel does not save data; it adds roughly a tenth. Mayak tries four routes without your involvement and re-establishes the tunnel by itself when the network changes.
We make Mayak, a private network with its own Android app that finds a working route on your network by itself. This article is about mobile data in general; only one section is about us.
🍎 On iPhone Mayak works with the subscription link from your account, in Happ or INCY (INCY is in the Russian App Store): where to tap on iPhone.
How mobile data differs from Wi-Fi
| What | Home Wi-Fi | Mobile data |
|---|---|---|
| Phone’s address | The same for hours | Changes when you leave home, on the road, in the metro |
| Route to the server | Usually works on the first method | Different methods get through at different operators |
| IPv6 | Not every provider has it | Some operators have it, and the route over it can differ |
| Signal | Steady | A weak signal looks just like the network refusing |
| Data | More often unlimited | Often a gigabyte allowance, so the tunnel’s overhead shows |
How much all this matters shows in our connection log for 30 days, 23 August to 22 September 2026: on mobile data 782 attempts out of 817 came up (95.7%), on Wi-Fi 1,096 out of 1,118 (98.0%). The gap is twofold, but small either way: if yours fails every time, something specific is going on (the causes).
Switching networks on the move
You leave home, the phone moves from Wi-Fi to mobile data, and its address changes. The WireGuard family of protocols, which our AmneziaWG belongs to, survives this: the server learns the new address from the first correctly signed packet. But that packet has to be sent, and the phone may be asleep at that moment.
So a good app does not wait; it re-establishes the tunnel itself when the network changes. A short break at the moment of switching is normal. If the connection stays gone for long after a switch, battery saving is almost always to blame: the phone put the app to sleep (explained with numbers).
When the first route does not get through: several attempts instead of one
On a mobile network it happens more often than at home that one connection method does not get through while another does. An app with a single route shows an endless “Connecting…” at that point. An app with several routes tries the next one by itself.
Mayak makes four such attempts, in order:
- Directly to the new-style address (IPv6), if your network has one.
- Directly to the usual address. Same server, different road.
- Through an entry point in Russia. Traffic enters our server inside the country and continues to the country you chose; encryption stays end-to-end.
- A fallback channel that looks like an ordinary secure web connection. It is slower, but gets through where the first three did not.
In the seven days to 20 September 2026, of 1,171 connections that came up, 1,050 needed only the first two attempts, 95 came up on the fallback channel and 26 through Russia (how we counted). The screen shows which route you are on: a “Via Russia” or “Backup” mark next to the status. How the app knows a route is alive — in a separate article.
IPv6 at mobile operators
At some operators the phone gets two addresses: the usual one (IPv4) and a new-style one (IPv6). The roads they take to the same server can differ — both in speed and in whether the connection gets through.
- In our test on Megafon in Moscow in July 2026, a connection without masking did not come up over IPv4 at all, while the same connection over IPv6 came up within a second.
- Between our data centres IPv6 turned out slower: its road is longer. Yet on MTS mobile data in Blagoveshchensk, by our observation, IPv6 comes out ahead — that is an observation, not an instrument measurement.
The single conclusion: you cannot guess in advance which road is better at your operator. That is why IPv6 is Mayak’s first attempt, and if it does not answer, the app moves to the usual address within a fraction of a second. Do not turn off “Use IPv6” in the settings: without it you lose that attempt. More in IPv4 vs IPv6.
What we measured at the operators
All measurements below were taken in Moscow. Operators in other regions may behave differently, so read them as an example, not a promise.
| Operator | What we measured |
|---|---|
| Megafon | Without masking the connection did not come up; with masking it came up and worked (July 2026) (details) |
| MTS | The connection came up, but traffic stopped after two or three seconds; with masking it works (July 2026) (details) |
| Beeline | No interference on 28 July 2026. On 16 August one phone’s direct route did not come up and it connected through Russia — a single observation, not a measurement (details) |
| Yota | Runs on Megafon’s network; not measured separately (details) |
| Tele2 (t2) | Not tested (details) |
Masking is the shape of a connection’s first packets. In current builds of our app it is on by default; there is nothing to configure. Why “switch the port to 443” does not help and how the Megafon and MTS cases differ is covered in “Why a VPN fails on mobile data but works on Wi-Fi”.
A separate case: if on mobile data only Gosuslugi, your bank and marketplaces open and nothing else does, the app is not the issue — the network is in a different mode (what it is).
A weak signal looks like a refusal
This is the most common false alarm on mobile data. With poor reception the connection’s first packets get lost, and the screen shows the same endless “Connecting…” as a real refusal. We once logged such a case as “the operator does not let it through” ourselves; a recheck in a spot with normal signal brought the same connection up within a second.
Practical rule: before changing the app or the settings, try again where the signal is better. If it connects there, the radio was the problem.
Data and battery
- Data. A tunnel does not save data; it adds some. In our test on the night of 16 September 2026, the same 20 MB download cost 10.7% more through the tunnel on the Netherlands line and 10.1% more on the Polish one. With the tunnel on and you doing nothing, about 3 MB a day goes out (the full test).
- Battery. A little extra drain is normal: the phone encrypts all traffic. A poor signal heats the phone the most: packets get lost and are sent again. We have not measured battery drain with the connection on, so there is no number here.
- Russian apps outside the tunnel. Banks and Gosuslugi can go direct with the “RU Apps” preset on the main screen: they are meant to see your usual address (how to turn it on).
What to switch on in the phone
- Unrestricted background work. Phone “Settings” → “Apps” → the service’s app → “Battery”. Our app notices such a restriction itself and leads you to the right screen.
- Always-on. Then Android itself keeps the protection up, after sleep and after a restart. In Mayak: “Settings” → “Protection” → “No protection — no internet”; the button opens the system screen (step by step).
- Leave “Use IPv6” on. It is the first connection attempt.
- “Check connection” in the settings, if it will not connect: the app runs through every connection method by itself and tells you which one fails on your network.
- “Always use the backup channel” — only if the direct route never gets through at your operator. Then you do not wait for the attempts each time, but the connection is slower than direct.
One more thing: Android runs only one such connection at a time. If the phone has a second service with “Always-on VPN” switched on, ours will not come up (that case explained).
Mayak on mobile data
- Four attempts without your involvement — IPv6, the usual address, the entry in Russia, the fallback channel. The screen shows which route you are on.
- Masking is on by default in current builds. As of 4 October 2026 the app version on the site and on Google Play is 0.7.40.
- Network switches: moving from Wi-Fi to mobile data and back, the app brings the tunnel up again by itself.
- One account for several devices. A phone’s address changes with every network switch, and we tie nothing to it: we count devices, not addresses. Plans are in the help centre.
- iPhone. No app of our own yet; you connect with a subscription link. There is no automatic route switching there: a third-party client gets one connection method from the link.
Try it on your own operator. Install the app, turn Wi-Fi off and connect. We ask for no payment details for the trial. A confirmed email opens the access — 3 free days on two devices. An email is optional: without one the trial is 1 day.
What we checked
- Operators — measurements in Moscow in July 2026 on Megafon, MTS and Beeline SIM cards; each variant differed from the next by one setting. Details and dates are in the operator articles.
- IPv6 on Megafon — the same test: a connection without masking came up over IPv6 and not over IPv4.
- Weak signal — same place: a connection that failed with poor reception came up within a second with normal reception.
- Mobile data and Wi-Fi shares — from our log for 30 days to 22 September 2026; attempts the person started themselves.
- Connection attempt shares — from the log for the seven days to 20 September 2026.
- Data — a 20 MB download with and without the tunnel, the night of 16 September 2026.
What we do not know
- How operators behave outside Moscow. All measurements are from Moscow.
- Tele2 and t2. Not tested; Yota not measured separately.
- How much battery the connection takes. Not measured on any model.
- How much data you personally use. We measured on our own servers with one large download, not on a phone on an operator’s network.
- How your network will behave today. Only you can see that. If it does not work, send the log (“Settings” → “Send log”) and tell us your operator and city.
Quick answers
Which VPN is best for mobile data? One with several routes to its server that tries them by itself. Test it on your own operator with Wi-Fi off: a ranking cannot show that.
Why does the VPN work on Wi-Fi but not on mobile data? The operator may not pass the connection method that works at home. Masking and fallback routes help — explained with measurements.
How much data does a VPN use on mobile? About a tenth more than without it, and around 3 MB a day when you are doing nothing.
Why does the VPN drop when I leave home? The phone changed network and address. A good app reconnects itself; if there is no connection for long, lift the background restriction.
Should I turn IPv6 on? In Mayak, leave it on: it is the first connection attempt, and at some operators it is the one that works best.
Does a VPN drain the battery on mobile data? A little extra drain is normal. Noticeable heating more often comes from a weak signal; we have no drain figures of our own.