Troubleshooting Android Clash background disconnects: VpnService permissions and battery optimization

Start by checking whether the VPN stopped or the connection failed to recover

If Android Clash disconnects when the screen is locked, check the system VPN status and client service before changing battery settings. Battery optimization exemptions are the main fix only when the background service has actually been stopped. If the VPN is still connected and the client logs show connections, look instead at the node, DNS, per-app proxy settings, or Wi-Fi-to-mobile handoff.

This guide applies to Clash clients that use Android VpnService to handle traffic, including clients powered by the mihomo core. Button labels such as “Start,” “Run,” and “VPN mode” vary by app. System menus also differ by Android version, manufacturer interface, and regional software build, so use the paths below as a guide and follow the menus on your device.

VpnService permissions: confirm that traffic routing is active

VpnService creates a virtual network interface for the app. The client then reads traffic, applies rules, and connects to the appropriate outbound server. Android clients usually handle this as part of starting the VPN. Unlike a desktop client, this does not require installing a TUN driver or opening a separate local proxy port to handle traffic from regular apps.

First-launch checklist

1. Import a valid configuration and select an available proxy group and node. While the screen is on, confirm that the node connects successfully.
2. Tap the client’s start button. When Android displays a “Connection request” or VPN permission dialog, check the app name, then tap Allow or OK.
3. Go to Settings → Network & internet → VPN and check whether the client is shown as connected. On manufacturer interfaces, search for “VPN” in Settings.
4. Open a website that requires a proxy and check the client’s connection history. Confirm that you can see both the VPN status and the destination connection with its matched policy.

The permission prompt is part of Android’s system flow. If you deny it, the client may still update subscriptions, but it will not route traffic from other apps. Downloading a subscription and establishing a VPN tunnel are separate steps. If you can’t tap the prompt, close floating windows, screen filters, or other overlays and try again. Don’t grant extra permissions to apps from untrusted sources.

Check for VPN conflicts and per-app settings

Usually, only one VpnService can be active for a given Android user or profile. Ad blockers, firewalls, and other proxy clients may use the same interface, so starting one can replace the current VPN. Work and personal profiles can each have their own VPN; an app being installed does not by itself indicate a conflict.

If only one app—other than the browser—cannot connect, check the client’s per-app proxy, app access controls, and bypass list. Excluded apps won’t use the proxy as expected. Apps in a work profile may also fall outside the VPN managed by your personal profile. Changing battery settings repeatedly won’t fix this.

Always-on VPN: recovery and blocking connections without a VPN

Android manages Always-on VPN and can try to start the selected VPN service in situations such as device startup. It cannot guarantee that a node will remain reachable or prevent every manufacturer’s background cleanup. The app must support this feature, and device administrators may restrict the setting on managed devices.

1. Go to Settings → Network & internet → VPN.
2. Tap the gear icon next to the client, or open the VPN details page.
3. If the page offers Always-on VPN, turn it on after confirming the connection works.
4. Leave “Block connections without VPN” off at first. Test recovery after locking the screen and restarting the device. Once everything works as expected, decide whether to enable blocking.

If the option is unavailable, check whether the client supports it and whether device management policies restrict it. Don’t try to force it on by editing YAML. After a restart, also confirm that the configuration is still accessible: data that requires manual unlocking, an expired subscription, or a startup failure can prevent Android from restoring the VPN.

Battery optimization exemptions: configure battery, background activity, and auto-start separately

Battery optimization, background activity, and auto-start are separate controls. Locking an app in the recent-apps list doesn’t grant background access, and allowing auto-start doesn’t prevent Android from restricting background network use. Change one group of settings at a time and retest so you can tell what helped.

Settings on near-stock Android

On common Android 13 and 14 interfaces, long-press the client icon → App info → App battery usage or Battery, then select Unrestricted. Some versions show Allow background usage followed by an optimization level. On other devices, search Settings for “Battery optimization,” switch to all apps, and select Don’t optimize for the client. These options may not all be available on your device.

Android’s Doze and App Standby features limit background activity. A battery optimization exemption can reduce some restrictions, but it won’t fix an app crash or restore a broken network connection. After changing this setting, monitor battery use and keep only the background exemptions you need.

Where to look in common manufacturer interfaces

These are common menu locations, not guaranteed paths for every version. If you can’t find the exact setting, search Settings for “background,” “startup,” “battery optimization,” or “sleep,” and make sure the final page applies to the client you’re troubleshooting. Android installation and VpnService instructions in this guide do not apply to Huawei system versions that can’t run Android apps.

Notification permission and locking the app in recent apps

Since Android 8.0, a continuously running VPN service uses the foreground service mechanism. Android 13 and later also require separate consideration of notification permission. Allowing notifications makes it easier to monitor the connection and stop the service, but denying permission does not necessarily prevent a foreground service from running. Android may still show it in the active apps view. Don’t assume that no notification means the VPN has stopped.

Locking an app in a manufacturer’s recent-apps view may prevent one-tap cleanup from closing it, but it doesn’t guarantee system-level background operation. During troubleshooting, don’t swipe the client away or tap Force stop in App info. Force stop is different from returning to the home screen; the app usually needs to be opened manually before it can start normally again.

VPN still connected? Check data access, nodes, and DNS

If the VPN page still shows a connection after the screen is locked, look for the actual error instead of adding more battery exemptions. First distinguish between an unavailable network, a failed proxy exit, and a DNS resolution failure. All three can appear as a browser timeout.

• Check mobile data access: Go to App info → Mobile data & Wi-Fi, or your manufacturer’s network access controls, and confirm the client can use the current network. If Data Saver is on, check whether the client needs unrestricted data access.
• Check node reachability: After unlocking, test the selected node again on the same network, then try another known-working node. A successful latency test doesn’t guarantee access to every website or UDP traffic.
• Check DNS logs: Look for resolution timeouts or upstream connection failures. Private DNS, available on Android 9 and later, can interact with DNS handling in the client. Test with Private DNS set to Automatic and note the original setting before changing it.
• Check new connections after switching networks: Switching from Wi-Fi to mobile data changes the underlying route and NAT state, which can break existing TCP sessions. Reload the page or make a new request and see whether the new connection works. Don’t judge by a single old download task.

Don’t copy desktop TUN settings just to fix background disconnects. Android clients may create their own VPN interface and configure routing and DNS interception. Whether the subscription’s tun fields take effect depends on the client. Changing mixed-port or setting the port to 7890 or 7891 won’t stop Android from killing the app process.

If the problem occurs only on one Wi-Fi network, test mobile data on the same phone first. If mobile data works, check the Wi-Fi captive portal, IPv6 routing, or upstream DNS rather than blaming Android background restrictions.

Retest with the screen locked: follow a consistent process

The times below are suggested test intervals, not a promise of uninterrupted operation. A short screen-lock test can catch obvious background termination but won’t cover every deep-sleep scenario. Unplug the charger before testing, since charging can change some battery-saving behavior.

1. Record a baseline: Note the Android version, system interface version, client version, core in use, and current Wi-Fi or mobile network. Record the state of Always-on VPN and “Block connections without VPN.”
2. Test with the screen on for 2 minutes: Open the target website and confirm that the connection log shows a new entry. Don’t run another VPN at the same time.
3. Lock the screen for 10 minutes: Don’t clear the recent-apps list. After unlocking, check the system VPN status before opening the client so you don’t hide the fact that the service stopped in the background.
4. Extend the test to 30 minutes: If the previous test passes, leave the screen locked for longer. Note how long it takes to restore access and whether you have to start the service manually.
5. Test network switching and restarting separately: Test Wi-Fi-to-mobile switching on its own, then test recovery after a restart and unlock. Don’t combine these two variables with the initial screen-lock test.

What to collect for further troubleshooting

Keep client logs from just before and after the failure, a screenshot of the system VPN status, and the exact time it happened. If you’re comfortable using ADB, you can read system status from a local computer. The commands below are read-only diagnostics; they don’t grant background permissions or change battery settings.

adb shell dumpsys deviceidle
adb shell dumpsys connectivity

deviceidle can show device idle-related state; connectivity can help inspect network and VPN information. Output formats vary by Android version, so don’t look for a single fixed field. Output may contain network addresses or app identifiers; share only relevant excerpts after removing sensitive details.

FAQ and final checks

After troubleshooting, keep the smallest set of settings that works: grant VPN permission, allow the client’s necessary background activity, enable the manufacturer’s auto-start option if needed, and turn on Always-on VPN if it suits your needs. Finally, repeat the screen-lock test without opening the client to confirm that the settings restore the connection on their own, rather than the app restarting when you open it.

To review configuration import and first-connection steps, see the Getting Started guide. If the service stays connected but traffic fails, continue troubleshooting the connection path in Troubleshooting.