How Clash for Android uses VpnService to build its local tunnel, what happens when battery optimization kills it in the background, and the exact steps to whitelist it on every major phone brand.
Desktop versions of Clash (and other mihomo-based clients) usually take over network traffic through system proxy settings or a TUN virtual adapter. Android's security model, however, doesn't let ordinary apps create a TUN device directly. Instead, Android exposes VpnService, an official API that lets an app build a local virtual tunnel once the user has explicitly granted permission, redirecting device traffic into the app for processing before it's forwarded according to proxy rules. Every Android build of Clash — Clash Meta for Android, the FlClash fork, Clash for Android, and others — goes through this same path. It's not a design choice made by any single client; it's the only entry point Android provides for "take over all network traffic" at the system level.
This matters because most issues that look like bugs later on actually come from Android's extra restrictions on VpnService-based apps, not from a flaw in the client itself. Any tunnel built with VpnService triggers a persistent key icon or "Connected to VPN" notice in the status bar — this is a mandatory Android security feature that warns users an app is reading their network traffic. Every proxy tool that uses this technical approach shows this icon; it can't be turned off, doesn't need to be turned off, and isn't a sign anything's wrong with the client.
After installing the client, tapping the connect toggle for the first time brings up a standard system dialog along the lines of "An app wants to set up a VPN connection that lets it monitor your network traffic." Android renders this dialog itself — the client has no control over how it looks and can only trigger it. Once you tap "OK/Allow," the system records the client as an authorized VPN app, and it normally won't ask again on future launches, unless the permission gets manually revoked in system settings or the client is reinstalled with a different package name or signing certificate (which Android treats as a brand-new app).
A process created by VpnService technically counts as a foreground service, and Android is less aggressive about cleaning up foreground services than ordinary background ones — but that doesn't make it immune to every power-saving mechanism. Recent versions of Android have kept expanding Doze mode and App Standby buckets: when a device sits idle for a while with the screen off and not charging, the system periodically suspends network access and CPU scheduling for apps that aren't whitelisted, even if they're running a foreground service notification. Custom ROMs from Chinese and other manufacturers — MIUI, ColorOS, and similar skins layer their own background-management logic on top of stock Android's power saving, and are generally more aggressive about it, which is why the same client can feel rock-solid on one phone brand and flaky on another.
Typical symptoms: the proxy stops working after the phone's been locked for a while, the key icon stays in the status bar but traffic has actually dropped, or the app needs to be manually reopened a few minutes after being backgrounded before it works again. All of these come down to the process being frozen or throttled by the system — the fix isn't tweaking the client's config, it's excluding the app from battery management at the OS level.
The steps below reflect the common menu layout across recent versions of each manufacturer's software. Exact menu names can shift slightly between OS versions — if you can't find an exact match, search Settings using keywords like "battery," "autostart," or "background."
Besides battery management, there are two other issues that get mistaken for a bad VPN authorization — worth covering separately.
Some Android clients let you choose which apps go through the proxy tunnel and which bypass it, using the addAllowedApplication/addDisallowedApplication APIs that VpnService provides. If you've set it to "only selected apps use the proxy" and forgot to add your browser or target app to the list, that app's traffic skips the tunnel entirely — showing up as "Clash says connected, but the browser still can't reach the site." Check whether per-app proxy mode is set to global or allowlist, and whether the app you're testing with is actually on the list.
Android clients commonly have a "Take over DNS" (or similarly named) toggle that, combined with TUN mode, routes DNS lookups through the tunnel and resolves them according to proxy rules too. If that toggle gets turned off by mistake while the system still has a bad resolution cached from the carrier's DNS, you'll see an intermittent pattern where some domains connect and others don't. In that case, try toggling Airplane Mode on and off to clear the system's DNS cache, then confirm the DNS takeover toggle is switched on.
| Symptom | What to check first |
|---|---|
| Tapping connect does nothing, no permission prompt | Check whether another VPN app is already holding the connection — disconnect it, then retry |
| Works fine at first, stops after the screen's been locked a while | Whether battery optimization, autostart, and high-power-usage are all whitelisted |
| Key icon stays in the status bar but sites won't load | Per-app proxy list, DNS takeover toggle, and whether the current node is actually working |
| Needs to be manually reopened after a few minutes in the background | Whether the manufacturer's autostart setting got reset to "smart management" by the system |
| Has to be re-authorized after updating the client | Normal — a changed signing certificate or package name is treated as a new app by Android |
Using Clash on Android boils down to one chain: VpnService authorization → tunnel setup → traffic forwarding. That chain itself is reliable — nearly all real-world problems come from Android's battery management sitting outside of it. Add the client to the battery optimization whitelist, allow autostart, confirm high-power-usage permission, and then check the per-app proxy list and DNS takeover toggle are set the way you expect. That covers the vast majority of stability issues you'll run into day to day. Menu names vary by manufacturer, but the underlying logic is the same — on an unfamiliar phone, searching Settings for "battery," "autostart," or "background management" will usually get you to the right toggle.
Get the official installer for Android and other platforms, then follow the setup guide to finish your first configuration.