Protocol choice matters more here
A phone changes networks constantly — cell to Wi-Fi, tower to tower, sleep to wake. Every transition requires the tunnel to re-establish, and on OpenVPN that is slow and expensive. WireGuard reconnects almost instantly, which is why it is both faster and lighter on battery in practice.
IKEv2 was the mobile answer before WireGuard for the same reason and remains a reasonable fallback.
Use the operating system setting
Android has a native always-on VPN with a block-connections-without-VPN option. It is enforced by the system rather than by the app, so it holds if the app crashes. It is the single most useful setting on mobile and it is off by default.
iOS does not expose the same toggle in ordinary settings; the equivalent requires a configuration profile or a supervised device. In practice, the app’s own on-demand rules are what most iOS users have, and they are weaker.
Split tunnelling on mobile
Per-app rules solve real problems: banking apps that refuse foreign addresses, and apps that need the local network. They also silently remove protection from whatever you exclude, and the list is easy to set once and forget.
Review it occasionally. An exclusion added to fix one login two years ago is still there.
Avoid
- Leaving the client on an old protocol because it was the default at install
- Excluding a browser from the tunnel — it is the app most worth covering
- Assuming the VPN reconnects after a reboot; check, because on iOS it frequently does not without on-demand rules
What to expect from battery
With WireGuard on a modern phone the cost is small and usually invisible against the screen. If you see a large VPN entry in battery statistics, the likely causes are an old protocol, a distant server forcing more retransmission, or a client that reconnects repeatedly on a poor signal.