Answer first: the setting is designed to stop non-VPN traffic
Android separates Always-on VPN from Block connections without VPN. Always-on VPN tries to keep the VPN active. The blocking option prevents traffic from falling back to a normal Wi-Fi or cellular path when the VPN is unavailable.
| State | Expected behavior |
|---|---|
| VPN connected | Traffic uses the VPN |
| VPN disconnected, blocking off | Normal network traffic may continue |
| VPN disconnected, blocking on | Non-VPN traffic is blocked |
Where to check the setting
- Open Settings.
- Open Network & internet → VPN. If the menu differs, search Settings for “VPN.”
- Open the settings icon for the relevant VPN.
- Check Always-on VPN.
- Check Block connections without VPN if the option is present.
On a personally managed device, turning off the block can restore ordinary network access when the VPN is disconnected. That also means the traffic is no longer protected by the VPN, so do not disable it without understanding why it was enabled.
Do not confuse VPN lockdown with Private DNS or APN
| Setting | Purpose |
|---|---|
| Always-on VPN | Keeps or restarts a VPN connection |
| Block connections without VPN | Blocks traffic that is outside the VPN |
| Private DNS | Controls DNS resolution behavior |
| APN | Defines cellular packet-data access settings |
If both Wi-Fi and cellular stop working immediately after the VPN disconnects, check VPN lockdown before changing APN settings.
Managed phones and work profiles are different
Android Enterprise allows administrators to configure VPN behavior and restrict whether users can change VPN system settings. Work-profile VPNs can also apply only to managed work apps. If this is a company-managed phone, do not disable the policy on your own; contact the administrator.
Official sources
- Google Android Help — Connect to a VPN on Android
- Google Android Enterprise Help — Set up VPN on Android devices
Menu names can vary by Android version, manufacturer, VPN app and device-management policy.
