In short: An always-on VPN combines two independent mechanisms: Always-On VPN (automatically brings up the tunnel on device start and network change) and "Block connections without VPN" (a kill switch that prevents any traffic from bypassing the tunnel). On Android, both are system-level toggles in VPN settings. On a regular iPhone, there is no system Always-On — the equivalent is On-Demand mode in the app (e.g., WireGuard). This matters because traffic can leak when your phone restarts, switches between Wi-Fi and mobile data, or reconnects to a saved network. In 2026, Android 16 introduced a specific flaw that can bypass both protections — details below.
Always-On VPN vs Kill Switch: What Each Actually Does
These terms are often used interchangeably — that is a mistake. They serve different purposes and you need both:
- Always-On VPN — automatically starts and maintains the VPN tunnel: at boot, when switching between networks, when returning from airplane mode. The tunnel comes up without any action from you.
- Kill switch ("Block connections without VPN" on Android) — blocks all internet traffic while the tunnel is down or reconnecting. Without this, a brief VPN drop exposes your real IP.
- Connect On Demand (iOS) — the practical always-on equivalent for regular iPhone users: the app reconnects automatically based on configurable rules.
For a broader look at how a VPN handles your traffic, see how a VPN works. Here we cover both mechanisms together — because you need both for uninterrupted protection.
| Feature | What it does | Platform |
|---|---|---|
| Always-On VPN | Auto-connects on boot and network change; no manual action needed | Android 8+; iOS only on MDM/supervised devices |
| Block connections without VPN (kill switch) | Blocks all traffic while the tunnel is down; internet drops until VPN reconnects | Android (system toggle) |
| Connect On Demand / On-Demand | App reconnects automatically on specified networks; practical always-on for iOS | iOS (any iPhone via WireGuard and similar apps) |
| Per-app VPN | Tunnel only for selected apps; other traffic goes direct | Android, iOS (typically via MDM) |
Why Run VPN All the Time: Real-World Scenarios
It might seem sufficient to enable VPN only before sensitive tasks. In practice, that approach has gaps:
- Public Wi-Fi (cafes, airports). Your phone connects to a known network automatically, before you have a chance to enable VPN manually. A few seconds of unprotected connection is enough for a session token to be intercepted.
- Wi-Fi to mobile data switchover. Every time the phone changes network type, VPN disconnects and reconnects — during that window, traffic is exposed.
- Device restarts. Without always-on configuration, traffic runs unprotected from boot until you manually open the VPN app.
- Background apps. Messaging apps, email, and photo sync wake up immediately after boot — before the user has a chance to start the VPN.
- Accidental IP leak. When working with remote desktops, cloud storage, or corporate resources, your real IP should never be visible on the remote end.
- Complement to split tunneling. If you route some traffic outside the tunnel, always-on ensures that choice is deliberate — not an accidental gap.
How to Set Up Always-On VPN on Android
Android 8 and above has both required toggles built into the OS. Path on stock Android:
- Open Settings → Network & Internet → VPN.
- Tap the gear icon next to the VPN profile you want to make permanent.
- Enable "Always-on VPN" — the tunnel will connect automatically on boot and network changes.
- Enable "Block connections without VPN" — this is the system-level kill switch.
- Restart your phone and confirm that VPN connects on its own and that internet works.
To get LiMP VPN running as a persistent service, visit LiMP VPN for Android and follow the setup guide.
Note: with both toggles on, internet will disappear if your connection is unstable — that is the kill switch doing its job while it waits for the tunnel to come back up. If this is a recurring issue, see our article on VPN not working on Android.
Android 8+ and Shell Differences (MIUI/HyperOS, One UI)
Custom Android skins rename the VPN settings path, but the underlying toggles are the same:
- MIUI / HyperOS (Xiaomi): Settings → Connections → More connection settings → VPN → gear icon.
- One UI (Samsung): Settings → Connections → More network settings → VPN → gear icon.
- ColorOS (Oppo/Realme): Settings → Other networks → VPN.
"Always-on VPN" and "Block connections without VPN" are present in all Android 8+ skins — manufacturers do not remove these system settings.
How to Make VPN Always-On on iPhone (and Why It Works Differently)
An honest note upfront: system-level Always-On VPN on iOS is only available on supervised/MDM-managed devices — corporate-issued phones managed through Mobile Device Management. On a personal iPhone bought in a store, this option does not exist in system settings.
For regular iPhone users, the practical equivalent is On-Demand mode in the VPN app itself. Here is how to enable it in WireGuard:
- Open the WireGuard app on your iPhone.
- Tap the tunnel you want → tap Edit.
- Enable the "On-Demand Activation" toggle.
- Set rules: for example, "activate on all networks" or "activate on Wi-Fi, except home network".
WireGuard with On-Demand reconnects automatically on every network change — behavior that is functionally identical to Always-On for most use cases. WireGuard uses ChaCha20-Poly1305 for encryption (not AES-256) and runs in userspace on iOS, not at the kernel level. For more on choosing a secure protocol, see the safest VPN options.
The LiMP VPN app for iPhone supports On-Demand mode — simply enable the corresponding option in app settings.
What About Desktop: Windows and Mac
Windows and macOS have no OS-native always-on toggle equivalent to Android's. Continuous protection relies on two app-level settings:
- Auto-start on login — the VPN app launches with the OS and connects immediately.
- App-level kill switch — blocks traffic when the tunnel drops (the app equivalent of Android's system toggle).
Both options are available in most desktop VPN clients. Enable both in LiMP VPN's desktop app settings.
2026 Caveat: Android 16 Traffic Leak
In May 2026, Mullvad researchers and the GrapheneOS team confirmed a vulnerability in Android 16 informally called "Tiny UDP Cannon." The flaw is in the ConnectivityManager component: a malicious app can push some UDP/QUIC traffic outside the VPN tunnel even when both Always-On and "Block connections without VPN" are enabled.
Google's response: "Won't Fix (Infeasible)" — citing Play Protect as the primary defense. GrapheneOS shipped a patch. Mullvad published a temporary ADB workaround: disabling the vulnerable QUIC feature.
How serious is this in practice? The attack only works if a malicious app is already installed on the device. If you install apps exclusively from Google Play and keep permissions minimal, the real-world risk is low. The lesson: always-on VPN is necessary, but it does not replace careful app hygiene.
Checklist: Enabling Continuous Protection
- Android: Settings → Network & Internet → VPN → gear icon → enable "Always-on VPN" and "Block connections without VPN".
- iPhone: Open LiMP VPN → find the On-Demand option → enable it and set rules for the networks you want covered.
- Windows / Mac: In the VPN app, enable "Launch at startup" and the kill switch.
- Choose a trustworthy provider. The Android toggles work with any VPN app, but a provider that logs your traffic makes always-on protection meaningless.
- Install apps only from verified sources. "Tiny UDP Cannon" requires a malicious app — do not give it a foothold.
- Verify the kill switch is working. With kill switch on, disable VPN manually and confirm that internet is blocked. Re-enable — internet should return.
- Check for leaks periodically. Running an occasional IP and DNS leak test every few weeks is good practice even with always-on enabled.
Frequently Asked Questions
Does an always-on VPN drain the battery noticeably?
Slightly — the tunnel is active at all times. WireGuard (ChaCha20-Poly1305) is much more efficient than OpenVPN. The real-world difference is small for most users.
Can I run always-on VPN for just one app?
Yes — through per-app VPN or split tunneling. Always-on can be combined with exclusions so certain apps bypass the tunnel while protection remains continuous for everything else.
Why did my internet disappear after enabling "Block connections without VPN"?
That is the kill switch working as intended: all traffic is blocked until the tunnel comes up. It normally recovers in a few seconds. If the outage persists, check that your VPN profile is still active.
Does Always-On protect against IP leaks on Android 16?
Against normal scenarios — yes. Against the "Tiny UDP Cannon" flaw — only if no malicious app is installed. Google has not issued a patch; GrapheneOS has. Install apps only from trusted sources.
Do free VPN services support always-on?
The Android system toggles work with any VPN app, including free ones. The problem is provider quality: free services are more likely to log traffic, making always-on protection pointless from a privacy standpoint.
How is iPhone On-Demand different from system Always-On?
System Always-On is an OS-level feature available only on MDM/supervised corporate devices. On-Demand in the app gives regular users the same practical result: automatic reconnection on the networks you configure.
Do I still need a kill switch if Always-On is already enabled?
Yes. Always-On brings up the tunnel; the kill switch closes the gap during reconnection — those fractions of a second when traffic could slip through. Enable both.