VPN on Android: which client to use and how to set it up

With one LeoTun account, an Android phone or tablet can run any of four clients, and at home the router can do the work instead.

• Hiddify: import by QR code; one profile carries the server, credentials and routing rules, so there is nothing to type. Fastest on lossy networks.
• Cisco (AnyConnect): enter an address, a username and a password — no profile to import. It runs over TLS, so it is the steadiest on restricted networks and has the best compatibility.
• Private network (Tailscale): log in once with your site account and stay online, change exit region from the menu, and reach your other devices on the same account.
• OpenVPN: install OpenVPN Connect and import one .ovpn file; the profile already carries your username and password.
• Router: join the Wi‑Fi of a router running our firmware and the device is on the route with nothing installed. This is the one for TVs and boxes.

• One phone for everyday use, or mobile data with packet loss: Hiddify.
• Dormitory, campus or office Wi‑Fi that restricts UDP: Cisco. Hiddify, the private network and OpenVPN all use UDP and slow down or drop on such networks.
• Travelling, or a one-off need: Cisco or Hiddify — type an address or scan a code and you are connected. See the travel guide.
• A phone, a tablet and a couple of computers, set up once and forgotten: private network — see the multi-device guide.
• Inside China and wanting Chinese apps and sites to go direct: Hiddify, switched to “auto split” in the client.
• Abroad and watching Chinese video: any of the four clients, with the China region selected.
• TVs, boxes, a grandparent’s phone: router. Join the Wi‑Fi and it works.
• The full comparison is in which method fits which scenario.

All four clients have an illustrated Android tutorial; this section points to them. Installers are in the install area of each method’s page, and the download center on the contact page collects them in one place, reachable from inside China.

• Hiddify: download it on the Hiddify page and scan the QR code there; Google Play also carries it. Screenshots are in importing a Hiddify subscription.
• Cisco: the installer is in the install area of the Cisco page, and the address for each region is in the region list. For screenshots, choose the Android tab in the AnyConnect guide.
• Private network: install Tailscale from the download area of the private network page, tap “⋯” on the signed-out screen, choose Use custom server and enter the address shown on that page. Screenshots are in the private network guide.
• OpenVPN: install OpenVPN Connect from the OpenVPN page, log in and tap a region’s flag to download its .ovpn file, then import it. Screenshots are in the OpenVPN guide.

• An “unknown source” prompt during install: when an installer comes from a web page, the system or a security app asks once. Allow it.
• A VPN permission request on first connection: allow it. Android asks this of every VPN client.
• Battery saver killing the client: Android’s background limits shut the client down, which shows up as a drop shortly after the screen locks. Whitelist the client and turn battery optimisation off for it.
• Private DNS: with this kind of encrypted DNS setting on, the phone resolves names on its own. Behind the router it makes that phone bypass the route, so turn it off; on a phone running a client, if you are connected but some sites will not open, turn it off and try once more.
• Run one device-wide method at a time on the same phone. Cisco, the private network and Hiddify compete for network settings when they are on together.
• With Hiddify, scan the QR code separately on each device: one profile connected from two devices uses two device slots.

People searching for a VPN APK for their TV mostly want the living-room TV or box to just work. Our approach is to put the route on the router: the TV or box joins that Wi‑Fi and is on the route, with nothing to install and no TV build of any app to hunt for.

The router counts as one device, and the TVs, boxes and tablets behind it are not counted separately. You can flash your own or buy a pre-flashed unit — see the TV and grandparents guide and choosing a VPN router.

If one TV or box is on the router but bypasses the route, check for “Private DNS” or “Secure DNS” on it first, then make sure it is on this router’s Wi‑Fi.

1. Log in to this site and check the account expiry. Expiry is the most common cause; a new account needs a trial or a payment before it has any time.
2. Check that the phone’s time is set automatically. Encrypted connections need the clock to be within a few minutes.
3. Try another region. If that one connects, only the first server was temporarily unreachable.
4. Change network: if Wi‑Fi fails, try mobile data once, and the other way round.
5. Change method. If the UDP methods (Hiddify, private network, OpenVPN) fail, switch to Cisco over TLS; it is the same account, with nothing extra to activate.
6. Frequent drops: do the whitelist and battery steps from the previous section first. Moving between Wi‑Fi and mobile data rebuilds the connection, which is normal — the private network recovers on its own, the other methods need one reconnect.
7. Hiddify cannot fetch the subscription: the account expired or the password changed, so scan the QR code on this site again. If the import worked but the connection times out, tap “update subscription” in the client or change region.
8. Still stuck: bring the method, the region, the exact error text and the time to a support group on the contact page. The longer checklist is in the troubleshooting guide.