Understand VPN permissions and background operation
Clash Meta for Android is often abbreviated as CMFA. It uses Android's VpnService to create a local VPN interface, then passes the captured traffic to the core for processing. Your configuration's rules, proxy groups, and nodes determine how connections are routed. System VPN permission only allows the app to create this interface; it does not provide a subscription or guarantee that a node is available.
Seeing “VPN connected” on Android doesn't mean every connection goes through a remote proxy. Rules can send some traffic directly, and per-app settings can exclude specific apps from the VPN. When troubleshooting, check these separately: whether the tunnel is active, whether the app's traffic is routed through it, and whether the rules select the intended route.
| Setting | What it does | What it doesn't replace |
|---|---|---|
| VpnService permission | Allows the app to create a local VPN interface | Importing a subscription or selecting a node |
| Battery optimization exemption | Reduces background restrictions imposed by system standby policies | Doesn't guarantee that the manufacturer's process manager won't stop the app |
| Background launch permission | Allows background components to start or resume in specific situations | The initial VPN permission prompt |
| Locking the app in Recents | Reduces the chance of closing the app when clearing recent apps | Battery and network permissions |
First connection: grant VpnService permission
Follow “Configure → Start → Confirm”
- Open Clash Meta for Android and go to “Profiles” to import an existing subscription URL or local configuration. Wait for the import to finish, then select the profile you want to use.
- Return to the main screen and tap the start control. Depending on the version, it may appear as “Stopped,” a start icon, or a service status card.
- Read the Android “Connection request” or VPN confirmation prompt. Make sure the app name matches the client you're using, then tap “OK.”
- Check the system VPN status and the client's running status. Some devices show a key icon in the status bar; others display VPN status in the quick settings panel.
- Go to “Proxy” and check the selected proxy group. Open a website you use regularly, then review “Logs” for connection details and errors.
The system confirmation prompt usually appears only when permission hasn't been granted, has expired, or you've switched VPN apps. It won't appear every time you start the client. Android 13 and later may also ask for notification permission; this is separate from VPN permission. Notifications make it easier to check the running status, but denying them doesn't necessarily prevent the VPN from starting.
No prompt? Check for another VPN
Typically, only one VPN service can be active per Android user or work profile. Ad blockers, firewalls, corporate VPNs, and other proxy clients may already be using it. Stop other VPNs in the same profile, then try starting CMFA again. Don't rely on the app name alone: some filtering tools also use a local VPN interface.
Open system “Settings,” search for “VPN,” and tap the gear icon for the current VPN. If another app has “Always-on VPN” enabled, check what it's used for before deciding whether to turn it off. Organization-managed devices may restrict VPN changes; contact your administrator if needed. If you can't tap the confirmation button, temporarily disable overlays such as floating windows or screen filters and try again. Don't accept repeated authorization prompts from unknown sources.
Battery optimization: adjust the app's battery settings first
Android's Doze and App Standby can restrict network access and background tasks while a device is idle. Manufacturers may add their own app-clearing policies. Even a continuously running VPN service isn't guaranteed to keep its process alive indefinitely. The goal is to reduce unnecessary restrictions, not to disable all battery-saving features.
Here are common settings paths for different Android versions. Menu names refer to the system versions listed and may vary by minor release, region, or device. If you can't find a setting, search system Settings for “battery optimization,” “background battery usage,” or “auto-start,” and make sure you're changing the settings for Clash Meta for Android.
| System version | Common settings path | What to check |
|---|---|---|
| Pixel / Android 13 | Settings → Apps → See all apps → Clash Meta for Android → App battery usage | Select “Unrestricted,” not “Restricted” |
| Xiaomi / MIUI 14 | Settings → Apps → Manage apps → Clash Meta for Android → Battery saver | Select “No restrictions”; also check auto-start permission |
| Samsung / One UI 6 | Settings → Battery → Background usage limits → Never auto sleeping apps | Add the client; also check that it isn't on the deep sleeping apps list |
| Huawei / HarmonyOS 4 | Settings → Battery → App launch → Clash Meta for Android | Set to manual management and allow auto-launch, secondary launch, and background activity |
| OPPO / ColorOS 14 | Settings → Battery → More settings → App battery management → Clash Meta for Android | Check options such as “Allow background activity” to keep the app running in the background |
| vivo / OriginOS 4 | Settings → Battery → Background power consumption management → Clash Meta for Android | Check background policy options such as “Allow high background power consumption” |
Also check auto-start and background data
- Xiaomi: On MIUI 14, check permissions under “Settings → Apps → Permissions → Autostart.” Some HyperOS versions call this “Background autostart.”
- Samsung: If you can't add the app to “Never auto sleeping apps,” check that “Unrestricted” is selected under “Settings → Apps → Clash Meta for Android → Battery.” There's no need to repeatedly switch back to Restricted just to add it to the list.
- Other systems: Long-press the app icon and open “App info,” then check its battery, mobile data, and notification settings. If Data Saver is on, also check background data and the “Unrestricted data usage” permission.
Change one group of settings at a time, then test with the screen off. Disabling all battery and data restrictions at once might restore the connection temporarily, but it makes the cause harder to identify and can increase overall battery drain. If background operation is stable but battery use is still high, check for frequent reconnects, unavailable nodes, or overly frequent health checks.
Locking the app in Recents, auto-start, and always-on VPN
Lock the app in Recents to prevent accidental closure
Open Recents and find the CMFA card. On Xiaomi and some other devices, you can lock it by long-pressing the card and tapping the lock icon. Other systems may have “Lock” or “Keep open” in the card's menu. Use this only if your device offers the feature; the same gesture doesn't apply to every Android device.
Locking the app mainly affects how Recents clears apps. It isn't a system battery exemption and won't prevent “App info → Force stop.” After you force-stop an app, it usually can't resume in the background as before; you'll need to open it again. Check cleanup utilities, game boosters, and extreme power-saving modes separately.
Enable auto-start if needed
If your client version offers an auto-start option, enable it in the app and grant the corresponding system auto-start permission. Then actually restart the device, unlock it, and check whether the service resumes. Turning on the switch alone doesn't confirm that startup works. Android version, whether the device has been unlocked since boot, and background launch restrictions can all affect the result.
Android manages “Always-on VPN”; the client's own auto-start option is an app setting. They are separate controls. If Android doesn't offer Always-on VPN, or the option is unavailable, don't try to enable it by changing unrelated permissions. When troubleshooting, note the original setting so you don't forget to disable traffic blocking when restoring connectivity.
VPN disconnects when the screen is off: narrow down the cause
First, establish a stable connection with the screen on, then unplug the charger and test. Charging affects when a device enters standby. Use the same test app, website, and node, and check again after the screen has been off for 1, 5, 15, and 30 minutes. These are suggested checkpoints, not measured battery-life figures or a guarantee that the connection will hold on every device.
| What you observe | Check first | Next step |
|---|---|---|
| VPN status disappears after unlocking | Whether the service stopped or another VPN took over | Check battery restrictions, app-clearing history, and system VPN settings |
| VPN is still on, but no apps can connect | Node, DNS, or underlying network changes | Check the logs, then test Wi-Fi and mobile data separately |
| Only one app has a problem | Per-app proxy settings, the app's background data, and rule matching | Confirm that the app is included in the VPN's traffic scope |
| Notifications are delayed but resume as soon as you unlock | The affected app's own battery and push notification settings | Check the affected app too; adding only CMFA to the battery exemption list may not help |
| Connection drops when switching from Wi-Fi to mobile data | Reconnection after a network change, carrier network, and data permissions | Note when the network switch occurred and check the logs for timeouts or DNS errors |
Test DNS and proxy nodes separately
If the logs show repeated DNS timeouts, check the subscription's DNS settings and current network connectivity first; don't immediately change battery settings. Android 9 and later also offer “Private DNS,” which can change how DNS requests are routed. On a personal device where changes are allowed, note the original setting, temporarily switch to “Automatic” for comparison, then restore it after testing. Don't remove settings required by your workplace or school unless you understand their purpose.
If the connection log repeatedly shows failed attempts to connect to a node, switch to a known-working node and keep the test conditions the same. A VPN icon only shows that the interface is active; it doesn't prove the remote service is working. Likewise, a website failing to load doesn't automatically mean the system killed the VPN.
Retest and report the issue
After changing settings, run a test on mobile data, one on Wi-Fi, and one after restarting the device. Change only one condition per test. Record when the screen went off and came back on, whether the VPN stayed connected, and whether you had to restart the service manually. This is more useful for diagnosing the problem than simply saying “background operation is unstable.”
- Device details: Record the phone model, Android version, full manufacturer OS version, and the version shown on the client's “About” page.
- Test conditions: Record the network type, whether the device was charging, whether Battery Saver was on, and the Always-on VPN status.
- Steps to reproduce: Include how long the screen was off, whether you cleared Recents, whether you switched networks, and whether the issue affects all apps or just one.
- Relevant logs: Include entries from shortly before and after the issue. Before sharing, redact subscription URLs, access tokens, node credentials, and personal domain names.
For further diagnosis, you can use Android debugging tools on a trusted computer to check the device's idle state. The commands below only read information and don't change battery policies. If you're unfamiliar with USB debugging, skip this step and rely on client logs and system screenshots instead.
adb shell dumpsys deviceidle
adb shell dumpsys connectivitydumpsys deviceidle can help show device idle status and exemption details; dumpsys connectivity can help show network and VPN status. Output varies by Android version, and seeing an app on a whitelist doesn't rule out manufacturer-specific background management. Diagnostic output may include network information, so review it before sharing.
Keep only the settings that solve the problem: confirm VPN permission, relax necessary background restrictions for the client, lock it in Recents if needed, and verify the result with screen-off and network-switch tests. This can reduce disconnects and makes it easier to review your settings after a system update. For more configuration details, see the user guide. If you have trouble importing a profile or connecting, visit the help center.