Setting up an Android VPN isn’t just about seeing the connect button change color. The subscription, system permissions, and actual traffic route all need to line up. After importing a subscription, check which apps the client handles and whether it stays connected when the screen is off. Follow the steps below in order, with a clear way to check each one.
Before Installing: Match the Client to Your Subscription
First, turn off any proxy and make sure your local network can reach familiar websites. If Wi-Fi is waiting on a sign-in page or the network itself isn’t working, complete the sign-in or fix the connection first. Otherwise, a failed subscription download and a failed route connection can easily be mistaken for the same problem.
The client is the app that applies the configuration; the subscription is how you get that configuration; and a route is a connection destination available in it. They’re not the same thing. Installing a client doesn’t automatically give you working routes, and having a dashboard account doesn’t mean the client has received a subscription.
Download the version suited to your device from the client section of the I8VPN user dashboard. For installation and setup instructions, see the client setup guide. If Android asks you to allow app installs from the current source, enable this only for a trusted source you intend to use, then turn it off after installation. Don’t judge an installer’s source by its app name or icon alone.
Clients differ in the protocols and configuration formats they support. Shadowsocks, VMess, Trojan, and VLESS are common proxy protocol names; Hysteria2 and TUIC are often used in QUIC-based proxy setups. Knowing the names doesn’t mean you need to enter settings manually, nor does it mean I8VPN supports every protocol. Follow the client compatibility notes and subscription details shown in the dashboard.
Get and Import Your Subscription: Check That the Configuration Is Complete
Sign in to the user dashboard, check your plan status and remaining data, then open the subscription or client configuration section. I8VPN requires no email address; create an account with a username and password. You need to sign in to get a subscription. The sign-in page, client download, and subscription link serve different purposes—don’t use the dashboard URL as a subscription address.
- Choose the format for your client. If the dashboard offers client categories or one-tap import, choose the option that matches the app you installed. Even when different formats can be copied as links, they may not be interchangeable.
- Add a remote configuration in the client. The option may be called “Configuration,” “Subscription,” or “Profile.” To import from a link, paste the full address into the URL field and give the configuration a recognizable name.
- Download and save the configuration. Make sure the client confirms the update, then check that routes appear in the list. If you only saved the address without completing the download, the list may still be empty.
- Enable the configuration you just imported. Some clients let you save multiple configurations, but only the selected one is active. Check the current configuration name, then choose a connection destination from the policy group or route list.
You’re done when the configuration updates without errors, routes or policy groups are visible, and the intended configuration is selected. A “Copied” or “Saved” message alone doesn’t confirm that the subscription downloaded successfully.
For “Unsupported format” or “Parse failed” errors, check the client type, subscription format, and whether you copied the full content. For “Download failed,” check your local network, account status, and the address. If the client offers “Update subscription through proxy” but you don’t have a working configuration yet, try a direct update if your network allows it. Don’t disable certificate verification just to download a configuration.
Grant VPN Permission and Understand Rules and Routes
Once you’ve selected a configuration and route, start the connection. Android will usually display a system connection request. Make sure it comes from the client you just installed, then allow the VPN connection. Normally, only one VpnService can be active in the same user profile. Another proxy, an ad blocker that uses a local VPN, or a firewall may take over from or conflict with the current client.
If another app disconnects after you start, check whether this kind of conflict is the cause instead of repeatedly importing the subscription. Work profiles, managed devices, and customized Android systems may have additional restrictions; follow your device’s management policies.
| Mode | What It Usually Means | What to Check |
|---|---|---|
| Rule-based mode | Routes traffic through a proxy, directly, or blocks it based on rules such as domain or address | Whether the target app is covered and which policy group matches |
| Global proxy mode | Traffic handled by the client is usually sent to the selected proxy policy | Per-app exclusions, system restrictions, and protocol support can still affect the outcome |
| Direct mode | Traffic handled by the client usually bypasses the remote proxy | Don’t rely on the VPN icon alone to tell whether you’re using an international route |
| Per-app settings | Use an allowlist or exclusion list to choose which apps the client handles | Whether the list’s meaning has been misread and whether the target app has been restarted |
For your first setup, keep the subscription’s default rules and avoid changing DNS, policy groups, and per-app lists all at once. To troubleshoot routing, temporarily switch to the client’s global proxy mode for comparison, if supported. Once you’ve checked the result, switch back to the rule-based mode that suits everyday use. Global mode doesn’t guarantee that every device connection is covered, so check any excluded apps in particular.
Labels such as IEPL dedicated line, relay, and direct describe a route or access method—not an Android permission or proxy protocol. Direct usually means the client connects to an overseas node; a relay uses an additional forwarding entry point; an IEPL dedicated line includes a dedicated cross-border transmission segment. The exact topology depends on the service details, so the name alone can’t tell you how the connection will perform. See the servers and routes directory when choosing a route, and judge it by how the target app actually works.
Allow Background Activity and Check for Disconnects When Screen Is Off
If apps work in the foreground but disconnect when the screen is off, the system may be restricting the client’s background activity. Android settings vary by version and manufacturer. Look in the app details under “Battery” or “Background activity,” or find the relevant option under “Battery optimization.”
- ✅ Allow background activity for the client, or exclude it from battery optimization. Available options depend on your device.
- ✅ If your system has separate controls for auto-start, background launch, or background data, check that they aren’t restricting the client.
- ✅ If Data Saver is on, make sure it isn’t blocking the client’s background network access.
- ✅ Lock the screen, unlock it, and check the connection status and logs. Then test whether the connection recovers after switching between Wi-Fi and mobile data.
Don’t turn off all battery restrictions for every app. Add an exception only for clients that need to stay active; this makes problems easier to isolate and limits the impact. Background activity and VPN permission are separate settings—one doesn’t replace the other.
If your system offers “Always-on VPN” and “Block connections without VPN,” understand what they do before enabling them. Always-on VPN can help maintain or restore the system VPN connection, but it can’t guarantee that the remote route will always be available. Blocking connections without VPN may cut off network access before the client is ready, and may affect network sign-in or direct connections from apps. If you’re new to this, test a regular connection first and decide whether to enable these options afterward.
Use Three Methods to Verify Your Connection
Use the same target app, route, and mode throughout your checks. If you switch between browsers or configurations, it’ll be hard to tell which setting made a difference.
Method 1: Compare Your Exit IP
Before and after connecting, use the same browser to visit a trusted public IP lookup site and refresh the result. If the request is actually going through the proxy, the exit IP will usually change. Geolocation databases can be inaccurate, so treat country and city labels as clues, not proof.
If the exit IP hasn’t changed, first check whether per-app settings exclude your browser or whether the IP lookup site matches a direct-connection rule. In rule-based mode, the lookup site can go direct while your target international website uses the proxy. So an unchanged IP alone doesn’t prove the connection has failed.
Method 2: Check Rule Matches and the DNS Route
Open the client’s connection history or logs, then visit the target website. Check whether its domain appears, which rule matches, and which policy or node is used. If there’s no related entry, first check whether the app is covered. If the traffic is marked direct, review the rules and policy group before switching routes.
DNS translates domain names into addresses. A trusted DNS test site can show where your DNS requests exit, but the resolver’s location alone doesn’t prove a leak: split-routing rules may intentionally use local DNS for direct connections and a different DNS route for proxied domains. Android Private DNS, secure DNS in your browser, and client DNS can also affect one another. Check the logs to see whether DNS is behaving as expected, and avoid changing every setting at once.
Method 3: Test the Target App and Compare Connections
Open the app you actually need and perform an action that makes a new request, such as refreshing a document, opening an uncached page, or loading new content. Seeing an old page, downloaded content, or the app’s home screen doesn’t prove that the current request worked. After changing per-app settings, fully close and reopen the target app if needed.
If you won’t lose unsaved work or interrupt an active session, disconnect and compare the result, then reconnect. Matching exit IP, rule logs, and actual app behavior provide stronger evidence than the VPN icon alone. The website may still be affected by account region, service policies, or an outage; a successful proxy connection doesn’t guarantee that the destination service will allow access.
Common Issues: Narrow Down the Cause
No routes in the list: Check the subscription update result and look for download errors or a format mismatch. You haven’t reached route connectivity troubleshooting yet, so there’s no need to keep tapping Connect. If you reset the subscription address, update with the new one rather than repeatedly refreshing the old, invalid link.
Connected, but websites won’t load: Confirm the selected configuration and policy group, then check rule matches, DNS, and the route. If you try another route, keep the other settings unchanged. If only one app fails, first check its per-app coverage and any error message from the app itself.
Stops working when the screen is locked or the network changes: First check whether the client is still running, then look for reconnection entries in the logs. If the subscription hasn’t changed, repeatedly deleting the configuration usually won’t help. Check battery restrictions, background data permissions, and recovery after network changes instead.
Selections stop working after a subscription update: A server-side configuration change may mean a previously saved node or policy selection no longer matches the available options. Review the current configuration, policy group, and routes. Don’t treat names in old screenshots as a permanent reference.