Protocol choice matters more here
A phone changes networks constantly — cell to Wi-Fi, tower to tower, sleep to wake. Every transition requires the tunnel to re-establish, and on OpenVPN that is slow and expensive. WireGuard reconnects almost instantly, which is why it is both faster and lighter on battery in practice.
IKEv2 was the mobile answer before WireGuard for the same reason and remains a reasonable fallback.
Setting one up on Android, and the setting that matters after
Install the provider’s app from Play, sign in, connect. That part is unremarkable and every provider we cover ships a working Android client. What decides whether it protects you is the next step, which the app will not prompt you to take.
Go to Settings → Network & Internet → VPN, tap the gear beside your provider, and turn on both "Always-on VPN" and "Block connections without VPN". These are enforced by the operating system rather than by the app, so they hold when the app crashes, is killed by battery optimisation, or fails to reconnect after a network change. They are off by default, and a phone without them is unprotected during exactly the moments a phone is most likely to drop a tunnel.
The manual route — Settings → VPN → Add VPN profile — exists for connecting to a corporate gateway or a server you run yourself. It supports IKEv2 and L2TP but not WireGuard, so it is the wrong tool for a commercial provider whose app already handles the protocol properly.
- Install the app, sign in, connect
- Settings → Network & Internet → VPN → gear → Always-on VPN: on
- Same screen → Block connections without VPN: on
- Settings → Apps → your VPN → Battery → Unrestricted, or Android will kill it in the background
Where iOS differs, and why it is weaker
iOS does not expose an always-on toggle in ordinary settings. The equivalent requires a configuration profile or a supervised device, which is why an employer can enforce it on a work phone and you cannot on your own. What most iOS users actually have is the app’s own on-demand rules, which are a weaker guarantee because they depend on the app.
The other iOS-specific gap is split tunnelling: of the four providers we cover, Proton VPN documents it on Windows, Linux, Android and Android TV, experimentally on macOS, and not at all on iOS. If per-app routing is why you are choosing a provider, check the platform list rather than the feature list.
Split tunnelling on mobile
Per-app rules solve real problems: banking apps that refuse foreign addresses, and apps that need the local network. They also silently remove protection from whatever you exclude, and the list is easy to set once and forget.
Review it occasionally. An exclusion added to fix one login two years ago is still there.
Avoid
- Leaving the client on an old protocol because it was the default at install
- Excluding a browser from the tunnel — it is the app most worth covering
- Assuming the VPN reconnects after a reboot; check, because on iOS it frequently does not without on-demand rules
What to expect from battery
With WireGuard on a modern phone the cost is small and usually invisible against the screen. If you see a large VPN entry in battery statistics, the likely causes are an old protocol, a distant server forcing more retransmission, or a client that reconnects repeatedly on a poor signal.