Browsing with a VPN on your mobile gives a false sense of security when we believe that All traffic passes through the encrypted tunnel And that nothing can escape. However, on Android (and other systems as well) there are important nuances: there are traffic leaks, operating system design decisions, and technical limitations that can break that supposed privacy "bubble" if you don't know what you're doing. Check Android's hidden settings to gain privacy.
If you would like to Maximum privacy on Android and block everything that comes out of your VPN.You need to thoroughly understand how the system works, what providers like Mullvad, NordVPN, and ExpressVPN are discovering, what options Google offers for businesses, and what limitations can't be overcome with just an app. We're going to take an in-depth look, with a practical and straightforward approach.
What does a VPN actually do on your mobile phone?
A VPN on your mobile phone creates a encrypted tunnel between your device and a remote serverEverything that goes through that "pipe" is encapsulated and travels securely to the VPN server, which is the one that accesses the internet "on your behalf" with its own public IP address. Websites, apps, and online services will see the IP address of the VPN server, not your actual connection IP address., which complicates basic IP address tracing.
In practice, when you activate a VPN on Android or iOS, you get a extra layer of protection on insecure Wi-Fi networks (airports, cafes, hotels…), you reduce your IP's exposure to websites and advertisers and can bypass geographical blocks as long as you respect the laws and terms of use of each service. However, It's not an antivirus or a magic solution for total anonymity.Your VPN provider can see the traffic passing through its servers, and you have to trust it.
On mobile devices, VPN settings often coexist with other network settings such as the APN (access point provider) or enterprise network features. These are distinct systems, but they are managed from similar areas within the settings, so it's important not to confuse them: the APN controls How do you connect to your mobile operator's network?while the VPN controls where your traffic goes to the Internet.
Why do you want to block everything coming out of the VPN tunnel?
When you activate a VPN "for security," you normally assume that There will not be a single package outside the tunnel.That's the ideal: either everything goes through the VPN, or the mobile phone loses its connection. This behavior is key if you have a demanding threat model: journalists, activists, people who travel to countries with censorship, professionals who handle sensitive data, etc.
Android has had this combination of options for years. “Always-on VPN” and “Block connections without VPN” within Settings → Network & Internet → VPN. On paper, Google documents that with these options enabled All traffic that does not use the VPN is blockedso that there are no "escapes" if the app crashes or if you switch Wi-Fi or mobile data in the middle of a connection.
In addition, many providers add their own layer of security with features such as Kill Switch or network protectionThe idea is simple: if the VPN disconnects, the app automatically cuts off your internet connection to prevent your data from being transmitted unencrypted. ExpressVPN calls it "network protection," others simply call it a "kill switch." In theory, by combining these features with Android's system options, you should achieve the goal of don't let anything out without going through the tunnel.
The problem: Android filters traffic even with a "secure" VPN
The delicate point is that, as has been reported Mullvad VPN in a security auditAndroid doesn't fully deliver on that promise. Their tests show that every time the device connects to a Wi-Fi networkThe system sends traffic outside the VPN tunnel even when the "VPN always on" and "Block connections without VPN" options are enabled.
This "escaping" traffic is not trivial: Mullvad has detected that it can leak source IP addresses, DNS queries, HTTPS traffic, and even NTP traffic (the protocol used to synchronize the time). All of this goes directly to the internet without going through the VPN server, precisely at the moment when Android is checking network connectivity.
Google designed the system this way for functional reasons: it needs to verify internet availability, detect captive portals (the typical hotel or airport networks that display a login page), and manage the connection status. The result is that Connectivity checks are intentionally sent outside the tunnelIn other words, it's not a one-off bug, but a behavior by design of the operating system.
Misleading documentation and Mullvad's pressure on Google
Mullvad's great anger stems not only from the escape itself, but from the The way Google describes the "Block connections without VPN" feature in its official documentation. Android currently explains that, by activating this option, "the system blocks any network traffic that does not use the VPN." That sentence, exactly as stated, makes it clear to any user that Not a single byte will leave the tunnel.
Mullvad has asked Google to correct the documentation To clarify that there is one exception: connectivity checks. They propose explaining that “the system blocks any network traffic that does not use the VPN, except for connectivity checksThey have also requested that Android incorporate a Option to disable those checks when using the lock, something like a third setting: “Disable connectivity checks”.
The reason is simple: for a user profile that seeks maximum privacy and anonymityThese leaks may be unacceptable. Although Mullvad acknowledges that, for most people, the practical risk may not be dramatic, in scenarios of high surveillance or data correlation, the risk could be significant. the source IP address, DNS queries, or the location of Wi-Fi access points They can help to deanonymize.
What data is being leaked and what can be inferred from it?
The traffic that Android sends out of the tunnel during these checks includes very juicy metadataEven if the message content is harmless (a request to check internet access, for example), contextual information allows patterns to be reconstructed:
- Source IP addresses: allow you to link your physical connection (your home, your work, the airport Wi-Fi) with the device that was supposedly “hidden” behind the VPN.
- DNS queriesEven if they are encrypted in some cases, simply seeing which domains you query or which servers you point to helps to profile your activity.
- HTTPS trafficThe encrypted content is not visible, but metadata such as SNI, times, packet sizes, and destinations are, which helps infer which services you use.
- NTP traffic: reveals time synchronizations and, combined with other data, can help in time correlation attacks.
According to Mullvad, a sophisticated actor who controls the connectivity verification servers or who can spy on the traffic on the network (such as an ISP or an entity with surveillance capabilities) can analyze this flow and associate it with Wi-Fi access point locationsConnection times and other patterns. It's not trivial or something within everyone's reach, but in certain threat contexts it's a real risk.
A bug was detected in Android 14 and its behavior when changing servers.
In addition to connectivity verification, Mullvad has detected that, in Android 14When changing VPN servers, the following occurs DNS query leaks even when the Kill Switch or system lock option is enabled. That is, by reconfiguring the tunnel and changing the endpointThe device even performs DNS resolutions outside the VPN.
This behavior is especially serious because it violates the most basic expectation of a user who has activated all system and app protections. The very idea of the Kill Switch is Prevent connectivity if the VPN is unable to protect trafficBut in practice, during that "interlude" of reconnection, Android lets DNS requests escape that could reveal queried domains and correlate the real IP with the IP of the previous VPN server.
Mullvad has proposed a compromise solution To mitigate the problem while Google works on fixing it: configure a type of mock VPN server or placeholder when the application is handling internal changes, so that Android continues to think the tunnel is active and doesn't send traffic out. Even so, they insist that the The fundamental solution must come from the operating system itself. and an update that closes these leaks.
Limitations: What VPN apps can't control
An important part of this story is understanding that the VPN apps do not control all system network trafficThey can request permissions, establish tunnels, and configure firewall rules within the limits of what Android allows, but They cannot rewrite the internal design of how the system verifies connectivity or manages captive portals.
That's why Mullvad and other suppliers emphasize that, in the face of these types of leaks, They can't fix it just from the app.What they can do is be transparent, warn users about the operating system's limitations, and try to introduce creative mitigations. But if Android decides to send certain requests outside the tunnel, The app is tied hand and foot..
Other failures have been seen in the past DNS leaks in VPN servicesThis can be due to both programming errors in the apps themselves and strange operating system behavior. A good practice, recommended by many providers, is Use official apps and standard clients like OpenVPN or WireGuard with manually downloaded configuration files. These clients are typically better audited and tested at scale, reducing the risk of added bugs and can be complemented with App Lock to protect sensitive applications.
ExpressVPN and network protection versus Android options
ExpressVPN offers a specific feature on Android called network protectionwhich is essentially an advanced kill switch. Its purpose is to automatically cut off the internet connection. if the VPN experiences an unexpected disconnectionso that no traffic leaves the device without being encrypted through the tunnel.
When network protection is enabled, Traffic is blocked for apps that need to use the VPN If there's a connection drop, but you'll still have access to the apps you've configured to bypass the VPN (split tunneling). In other words, if you choose to prevent certain apps from using the tunnel, they'll continue to have internet access even if the VPN goes down, while the apps that rely on the VPN will be blocked.
ExpressVPN very clearly differentiates its network protection from Android system settingsStarting with Android 8.0, you can enable "Always-on VPN" and "Block connections without VPN" for the ExpressVPN app in your system settings. If you do this, Android It absolutely blocks all internet activity. when the VPN is not active, even if you manually disconnect it. However, this configuration disables split tunneling and access to local devices (printers, computers, televisions, etc.), something that ExpressVPN makes clear so there are no surprises.
This combination (network protection + system-level blocking) comes very close to the idea of total exit barrierHowever, as we have seen, even with these options, Android still has those connectivity verification exceptions that no app can bypass.
NordVPN, TunnelCrack, TunnelVision, and how leaks are mitigated in other systems
The situation on Android contrasts with what some providers have done on other operating systems. NordVPN has openly discussed vulnerabilities such as TunnelCrack and TunnelVisionwhich affect the VPN industry in general. These techniques exploit router configurations, non-RFC1918 IP addresses, and DHCP manipulation to force some of the traffic out of the tunnel.
To combat this, NordVPN has introduced the feature “Remains invisible on a local network” on macOS and iOS. When activated, the app configures specific VPN API parameters for Do not expose the device on the local network.It alerts you when you connect to a potentially dangerous network and limits the paths traffic could take to escape the tunnel. They have also created a system of detection of unsecured networks which identifies suspicious IP ranges and recommends activating the feature.
However, on iOS they have encountered Limitations and flaws in the implementation of Apple's VPN APIStarting with certain versions (for example, iOS 14.2 and later), enabling this feature may cause internet blocks under certain conditions and even prevent the app from receiving client updatesThis ends up cutting off the connection until you restart your device. NordVPN acknowledges that this is an "inevitably drastic" solution until Apple fixes the problems they themselves have acknowledged.
What's interesting for our topic is that, in Android, Linux and WindowsNordVPN claims to have implemented mitigations that They prevent traffic leakage against these types of attacks. In Linux and Windows, for example, their apps They modify the operating system's firewall. to block any traffic that doesn't go through the VPN tunnel. It's a more radical and effective approach than what the Android API currently allows.
Android options for businesses: Always-on VPN and per-app VPN
Google, in its official documentation for IT administrators, details how to Manage VPNs in business environments through Enterprise Mobility Management (EMM) solutions. This affects both the built-in Android VPN (PPTP, L2TP/IPSec, IPSec) and third-party VPN apps.
In Android 7.0 and later, administrators can configure a “Always-on VPN” at the device or work profile levelThe system can automatically start the VPN service when the device boots up and keep it active while the profile is on. This feature integrates with the option to restrict VPN settings so that the user cannot deactivate it or change parameters on their own.
There is also the VPN per appThis allows you to define which apps can send traffic through the VPN connection. You can create allow lists (only these apps pass through the tunnel) or exclude lists (all apps except these pass through the VPN), but not both at the same time. If no list is defined, All traffic is sent to the VPN by default.This granularity is very useful in corporate environments where, for example, work apps are to use the VPN and personal apps are not.
Regarding system restrictions, in versions like Android 5.0 and 6.0, if VPN configuration is blocked, The VPN app won't startFrom Android 7.0 onwards, on fully managed devices, the app marked as always-on VPN by the device's policy controller can be launched, but No other VPN apps are allowedAll of this is part of the control ecosystem that Google offers to companies. minimize leaks and configuration errors by the end user.
How does all this affect your actual privacy?
The main function of a VPN is Encrypt your traffic on public networks and protect yourself from prying eyesFor most users, this protection is more than enough: it makes it difficult for someone on the same Wi-Fi network to spy on your data, prevents certain types of man-in-the-middle attacks, and stops websites and apps from easily seeing your real IP address. You can also supplement it with a... Firefox Focus browser for greater privacy while browsing.
The leaks described in Android primarily affect those who have a more aggressive threat modelFor example, if you fear that a government, an internet provider, or a large technology platform might try correlate your identity, your physical location, and your online activityTherefore, these connectivity checks and DNS leaks become more concerning. The metadata from the verification traffic can serve as pieces of a larger puzzle.
However, it's important to put things in context: Mullvad admits that, for many of its users, These leaks are unlikely to pose a catastrophic risk.Because exploiting this information effectively would require an actor with significant resources. Even so, their position is clear: if the system claims to block all traffic outside the VPN, There should be no silent exceptionsAnd if there are any, the user has the right to know about them transparently.
Practical tips to achieve “maximum privacy” on Android
Even though Android has these limitations, you can take several steps to Minimize traffic leaks outside your VPN and strengthen your privacy settings:
- Enable “VPN always on” and “Block connections without VPN” For your VPN app, go to Settings → Network & Internet → VPN, so that the system does not allow direct connections without going through the tunnel.
- Use your provider's Kill Switch or network protection (like ExpressVPN, NordVPN, etc.) within the app itself, so that the internet is blocked if the VPN drops without you intentionally disconnecting it.
- Avoid particularly sensitive Wi-Fi networks If you need strong anonymity at that moment; leaks associated with connectivity verification are usually triggered when connecting to new networks.
- Consider using standard clients like WireGuard or OpenVPN Use manual configuration files when your provider offers them, as they are usually better audited and minimize errors common in proprietary apps.
- Keep Android and apps updatedEspecially if you use Android 14, because Google may release patches that mitigate these behaviors or give the user more control.
- If your threat is extreme (sensitive investigative journalism, activism in highly hostile environments, etc.), consider using other operating systems or devices more focused on safety, at least for the most sensitive tasks.
Also, remember that a VPN does not replace other good practices: strong passwords, two-step authentication, and wariness of suspicious links And basic digital hygiene remains essential, whether or not you use an encrypted tunnel; also consider the Passkeys on Android as a secure alternative to traditional passwords.
Final Tips
In an environment where Android filters verification traffic, Apple has serious problems with its VPN API, and streaming platforms and other services are improving in the encrypted traffic detection and VPN pattern analysisVendors are responding with stealth features, intelligent routing, and more robust firewalls.
"]
Tools like Clean as Duck They help improve privacy. Ultimately, the key to achieving maximum privacy on Android lies in combining a good VPN provider, advanced system options, well-reviewed clients, and a conscious understanding of the operating system's actual limitations, assuming that "absolute protection" is more of a goal to strive for than a promise that can be 100% fulfilled today. Share the information so that more users are aware of the topic.