Understand the difference between a client, a subscription, and a server
Setting up an Android VPN takes more than installing an app. The client routes your device traffic, the subscription provides server configurations, and Android's VPN permission lets the client create a local tunnel. You also need to check routing rules and test real-world access. Miss any step, and you may see “Connected” while websites still won't load.
A subscription link usually contains credentials needed to access your configuration, so protect it like a password. It's not a regular tutorial URL or an app download link. Available servers appear only after the client reads the subscription. Account access, an active plan, a successful subscription update, and a working server are separate statuses; one doesn't guarantee the others.
New to NanNanVPN? Start with the setup guide, then get a compatible client from the download page in the user panel. You can create an account with a username and password—no email address required. Avoid installing apps shared in unfamiliar group chats or repackaged files.
Check the file source and compatibility before installing
If the download page offers multiple installers, follow its device compatibility notes. Processor architecture, Android version, and the client core all affect whether an app will run; a downloadable file isn't necessarily right for your device. If installation fails to parse, check system requirements and file integrity first—don't disable system protections.
- Get the client from the official download page, and make sure its app name, publisher, and release notes match the guide.
- Open the installer with your browser or file manager. If Android asks for permission, allow only the app you're using to install apps from unknown sources.
- After installation, revoke the temporary install permission so that source can't initiate future installations.
- When you first open the client, check its subscription and connection screens. Import the configuration as described in the guide, and avoid enabling advanced options without a reason.
A signature conflict with an installed app can mean that a version of the same client from another source is already on your device. Check whether the old configuration can be migrated safely, then follow the official instructions. Don't export or share the full configuration just to overwrite the app. Treat system risk warnings seriously; if you can't verify the source, stop.
Import your subscription and confirm it updates
Copy the subscription link from the user panel, then look in the client for “Subscription,” “Configuration,” or “Import from URL.” Paste and save the link, then run an update. You can rename the configuration to recognize it, but don't edit the link itself: missing credentials, altered escape characters, or extra spaces can prevent it from loading.
If the panel offers one-tap import, Android will try to open a compatible app. If nothing happens, copy and paste the link manually. A QR code may contain the same account configuration, so don't post screenshots of it in public forums. Clear the clipboard after importing, and hide links and credentials in any screenshots you share.
After updating, check that server names appear, the configuration is enabled, and your plan status and remaining data in the panel look right. An update can fail because the link has expired, your underlying connection can't reach the subscription URL, or the format isn't supported by the client. An “update failed” message alone doesn't mean every server is unavailable.
If you think your subscription credentials have been exposed, check whether the panel offers a reset option, or ask via the support page how to proceed. After importing the new details, disable the old configuration to avoid using outdated credentials.
Grant VPN permission and adjust background battery settings
When you select a server and connect, Android usually displays a system VPN connection request. Allow it only after confirming it came from the client you just installed. This permission creates the system VPN interface; it doesn't mean all traffic is reaching a remote server or prove that a particular website is using the VPN connection.
If another app that uses Android's local VPN interface is running—for example, some firewalls or ad blockers—it generally can't share that interface with your VPN client. Turn off the conflicting app and check the connection again instead of repeatedly competing for the system VPN slot.
- ✅ In the app's battery settings, allow background activity as needed or set the client to unrestricted.
- ✅ If your device has auto-start, background protection, or battery-optimization allowlists, add the client that handles the connection.
- ✅ After connecting, lock the screen, unlock it, and check the status. Test access on both Wi-Fi and mobile data, including after switching between them.
- ✅ Keep notifications that help you check connection status. If the app requests notification permission, follow its guidance.
- ❌ Don't grant unrelated permissions to fix a connection issue, and don't treat disabling all system battery-saving features as a default step.
“Always-on VPN” and “Block connections without VPN” are system-level options, not requirements for beginners. The latter can block network access if the client exits or the connection fails. Also distinguish between a local VPN interface that's still running and a remote server connection that's gone down: Android's blocking option can't replace the client's own traffic rules. Complete basic checks first, then decide whether you need these options.
Test the connection with real-world access, not just the icon
A reliable check combines the client status, access to the site you need, and your exit IP information. First confirm that regular websites work without the VPN, then connect to a server and visit an international site you actually use. Keep the test target consistent to reduce interference from website outages.
| What to check | How to check | What the result tells you |
|---|---|---|
| Connection status | Check the Android VPN indicator and the client's active configuration and server status. | Shows only the local connection status; it doesn't guarantee access to a particular site. |
| Target website | Open the site you need and test that pages load and its features work. | A page loading doesn't mean sign-in, media playback, or API requests will all work. |
| Exit IP address | Compare results before and after connecting using a trusted IP lookup site. | In rule-based mode, the lookup site may connect directly. IP geolocation databases can also be inaccurate. |
| DNS routing | Check the client's DNS settings, connection logs, and a trusted test site together. | A resolver's location alone doesn't prove a leak; interpret it in light of your routing rules. |
| Background activity and network switching | Repeat the website test after unlocking the screen and switching networks. | This can help identify background restrictions and reconnection issues, but doesn't guarantee a continuous connection. |
In rule-based mode, domains, IP addresses, or apps determine whether traffic connects directly or through the VPN. So an unchanged exit IP on a domestic site doesn't necessarily mean the configuration failed. To check an app, first see whether it's excluded from VPN routing, then check which rule matches its destination domain.
A DNS leak generally means requests that should be protected are taking an unexpected route. Android Private DNS, encrypted DNS in your browser, and the client's built-in DNS can all affect test results. Don't permanently disable encrypted DNS just to make a test page show a particular result. First work out which resolver handles your requests and which ones should use the VPN, then adjust your settings.
How to tell: Connection verification is complete for your use case when the target app follows the expected routing rules, its features work, and the connection recovers after locking the screen or switching networks. The VPN icon, server latency, or exit region alone isn't enough to draw a conclusion.
Troubleshoot the symptom instead of repeatedly reinstalling
Servers are listed, but you can't connect
First check that your internet connection works, your device date and time sync automatically, and your plan is active. Then update the subscription and try another server. If the client log reports an unsupported protocol or configuration field, check the app version and client core before changing server addresses, ports, or certificate verification settings at random.
The client says it's connected, but some apps won't load
Check per-app proxy settings, bypass lists, and routing rules. Some apps don't follow the standard system proxy, and whether a client using Android's VPN interface can route them still depends on its settings. If the client offers a global mode, you can temporarily use it for comparison. Restore your original settings afterward so unrelated traffic doesn't go through the VPN.
It works after unlocking, but disconnects when the screen is locked
Start by checking battery optimization, background app cleanup, and network switching. Find out whether Android is stopping the client or whether the app remains active while its remote connection drops. These need different fixes: the first calls for background permissions; the second requires checking reconnection settings and the current server. Repeatedly adding the client to allowlists won't fix both.
Websites load, but a service reports a region or account restriction
A working network connection doesn't grant access to a service. The platform decides which regions it supports and how it evaluates account status and risk; switching servers can't guarantee that a restriction will go away. If you need support, share your OS and client versions, when the error occurred, your network type, and a redacted error message. Never send your password, subscription link, or full configuration.
Choosing a server and data plan
Server type describes how a route is organized, not what results it guarantees. A direct connection usually means the client connects straight to the server entry point; a relay forwards traffic through an intermediate node. An IEPL link describes a specific dedicated segment, not a dedicated route from your device all the way to the destination site. Your experience also depends on your local network, entry-point congestion, exit route, and destination service, so test with the sites you regularly use.
NanNanVPN offers 90+ countries / 190+ routes and unlimited simultaneous connections. When using Android alongside other devices, keep your plan's data allowance in mind. Monthly plans include ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB, with data resetting monthly on the activation date. Mid-cycle upgrades are prorated by the remaining days.
For occasional use, compare the data packs: ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB. They last until used and never expire. See the plans page for details. You don't need to choose a higher tier just to install a client; base your choice on your actual usage.
NanNanVPN follows a no-logs policy, but that doesn't mean destination websites, other apps on your device, or account activity keep no records. Protect your subscription credentials and keep your client up to date, just as you would choose your server carefully. You can request a full refund for any reason within 7 days of your first payment. Test the connection early with your everyday network, background activity, and commonly used apps.