Always-on VPN and split tunneling: choose deliberately

Start with the behavior you need

Two people can reasonably want different VPN behavior. One wants a connection to resume when a phone restarts. Another wants a particular local-network application to work outside the VPN. These are separate requirements. Before looking for a switch, write down the outcome you need and which applications it applies to.

Android supports VPN capabilities that applications can integrate with, including always-on operation and per-app routing choices. Availability depends on the app and device configuration. This guide explains those concepts generally; it does not claim that every control described here is available in Fast Plus VPN. Check the actual app interface and documentation before relying on a feature.

Distinguish persistence from blocking

An always-on arrangement is intended to keep a selected VPN running or restore it under supported conditions. Blocking connections when the VPN is unavailable is a related but distinct behavior. Do not assume that a setting with the word always guarantees the exact failure behavior you expect on every device.

If a setting is available, read the system explanation before enabling it. Record the original configuration so you can undo the change. On a work-managed phone, a device administrator may control these settings. Ask the administrator rather than removing a profile that could be necessary for work access.

Treat an exclusion as a deliberate exception

Split tunneling describes sending selected traffic outside a VPN while other traffic uses it. An app exclusion may solve a compatibility problem, but it also changes the route for that app. The exception should be part of your privacy decision, not a setting you copy from a troubleshooting forum without understanding it.

For example, you might be investigating an app that communicates with a device on your home network. First establish that the failure appears only when the VPN is connected. Then check whether the VPN app offers a documented option relevant to that situation. If it does not, contact support rather than assuming an unrelated Android menu provides the same function.

Test the exact situation you rely on

Use non-sensitive activity when checking a new configuration. Observe what happens after reconnecting to Wi-Fi or restarting the device, if those events matter to your use. A browser test alone does not establish how a separately excluded app behaves. Keep the test narrow and avoid intentionally sending private information just to find out whether a route is blocked.

After testing, review the complete configuration once more. It is easy to remember that you enabled a protective option and forget the exception added several minutes later. Keep a brief note of why an exclusion exists and remove it when it is no longer needed. If you cannot establish the behavior you require, do not describe the setup as guaranteed protection. Ask for documentation that addresses that behavior specifically. Clear expectations are more useful than a collection of switches whose interactions you have not checked.

When you share a device with someone else, explain any intentional routing exceptions. Another user should not have to discover an excluded application through a failed assumption about the connection.