VPN on Google Pixel: Settings and Options

Google Pixel phones run Android in a form close to what the platform's designers intended, with few additions from the phone maker. For a VPN user that is mostly good news: the settings are where the Android documentation says they are, apps behave predictably, and updates arrive quickly. It can also lead to overconfidence, because the VPN menu offers choices whose meaning is not obvious, and a few newer features such as separate spaces change what a VPN actually covers.

This article walks through the VPN options on a Pixel and explains what each one is for. It covers the choice between a VPN app and a manual profile, the always-on and block settings, how Private DNS fits, what happens in Private Space and with multiple users, how updates and battery settings can interfere, and how to test the result. For the plain step-by-step installation that applies to any Android phone, use the Android setup guide. Menu names change between Android versions, so use the search box in Settings when a name looks different on your phone.

Two ways to add a VPN on a Pixel

Android lets a VPN reach your phone in two ways, and the VPN menu on a Pixel shows both.

A VPN app. You install an app from Google Play, sign in, and approve the system prompt that asks permission to set up a VPN connection. Android's official guidance on connecting to a VPN describes the prompt and the key icon that appears in the status bar once the connection is active. For consumer services, this is the normal path. The app picks the settings and handles reconnecting.

A manual VPN profile. Under the VPN settings there is an add button that lets you type in a profile by hand: a name, a type, a server address and credentials. This is intended for work networks and custom setups, where the administrator hands you the exact values. The built-in profile types are standards such as IKEv2, which RFC 7296 defines. If you do not have values from your provider telling you to use it, do not create a manual profile, because a wrong entry just gives you a connection that never works.

Question	VPN app	Manual profile
Who sets it up	The app	You, with values from an administrator
Typical use	Personal and travel use	Work networks, custom servers
Sign-in	In the app	Typed into the profile
Reconnects automatically	Usually, by the app	Depends on always-on
Troubleshooting	App-specific help available	Check every field by hand
Risk of typing errors	Low	High

If you are using a prepaid XPASS pass, the free VPNclient app signs in with the username and password on your My Pass page. The download page lists the official links for each device.

The options in the VPN menu, one by one

Open Settings, then Network and internet, then VPN. On a Pixel you will see each VPN you have added with a gear icon beside it.

• Always-on VPN. Android starts this VPN as soon as the phone connects to a network and reconnects it after drops. It works with apps that support the feature. For a phone you carry everywhere, it is the single most useful option.
• Block connections without VPN. Sometimes called a kill switch at the system level. When enabled, apps cannot use the network unless the VPN is connected. It helps against traffic escaping while the tunnel is down, but it can leave you with no internet when the tunnel fails or when you need a hotel sign-in page. Our explainer on the VPN kill switch describes the trade-off.
• Forget or remove. For an app-based VPN, forgetting it removes the entry; the app itself stays installed.
• Edit. For a manual profile only, lets you change server address and credentials.

On some Android versions these options only appear after the VPN app has been connected once. If the gear is missing, connect first and then return to the menu.

Private DNS and the VPN on a Pixel

A Pixel exposes the Private DNS setting in the same Network and internet area. It encrypts DNS lookups to a server of your choosing, and it interacts with a VPN in ways that depend on the mode. In short: Automatic mode rarely causes trouble, a fixed hostname can cause lookups to fail while a tunnel is active, and the only reliable answer is to test. The detailed walkthrough is in Android VPN and Private DNS: setup tips. If you only change one thing in that menu, leave it on Automatic and run a leak test with the VPN connected.

Private Space, multiple users and work profiles

Recent Pixels support several separate areas in which apps live.

• Private Space. On Android versions that include it, Private Space is a locked area with its own apps and its own lock. Whether a VPN connection on the main profile applies to apps in the private area can depend on the version and on the app. Test by connecting on the main side, unlocking the private area and opening an IP-check page there. If the displayed address is your normal one, install and sign in to the VPN app inside the private area too.
• Multiple users. A second user, or a guest user, is a completely separate profile. VPN settings do not carry across. If someone else uses your Pixel as a different user, they need their own VPN setup.
• Work profile. An employer may manage a work profile on your phone. The VPN rules inside it belong to the employer, and your personal app may not govern those apps. Do not try to override a company's VPN configuration.

The practical rule is simple: any time apps live in a separate space, test that space on its own.

Updates, battery and background restrictions

Pixels get frequent software updates. That is good for security, but it means behaviour can shift between versions. A permission prompt may change wording, a battery rule may become stricter, or a menu may move. After a major update, spend two minutes confirming the following:

1. The VPN app still opens, signs in and connects.
2. Always-on VPN is still selected.
3. The app is not restricted in battery settings. Look at the app's own info page, then Battery, and choose the unrestricted or non-optimised option if available.
4. Notifications for the app are still allowed.
5. An IP-check page shows the VPN's address.

The Adaptive Battery feature learns which apps you rarely use and limits their background activity. A VPN you reach for only now and then can be treated as a rarely used app. If your VPN drops after a long idle period, this is the first thing to check. Our article on whether a VPN drains your battery explains what to expect from the extra power use.

Scenarios that show the choices

The weekend traveller. Sam uses a Pixel on hotel and airport Wi-Fi. He turns on Always-on VPN, leaves the block option off, and connects to the hotel sign-in page first, then to the VPN. Read how to stay safer on public Wi-Fi for the wider habits.

The remote worker. Aiko has a work profile and a personal profile. The company VPN lives in the work profile. She installs her own VPN app for personal browsing and tests that the personal side shows the VPN address, while the work apps keep following the employer's rules.

The shared phone. A parent lets a child use the Pixel under a second user profile. The parent's VPN does not apply to that profile, so the child's profile either gets its own app or is used only on trusted networks.

The curious tester. Lee wants to check what the always-on setting really does. He switches Wi-Fi off and on, watches the key icon return in the status bar, and confirms with an IP-check page. If the icon takes a long time to return, he checks the battery rule and the app's reconnect behaviour.

Turning it off and fixing common problems

To disconnect, open the VPN app and tap disconnect, or open Settings, Network and internet, VPN and tap the entry. If the VPN is set to always-on, turning it off from the app may immediately reconnect it; to stop it for good, remove always-on in the gear menu. The general guide on turning off a VPN on any device covers this.

Symptom	Likely cause	What to try
Key icon disappears after a while	Battery restriction on the app	Set battery usage to unrestricted
Connected but nothing loads	DNS or route problem	Set Private DNS to Automatic; reconnect
No internet after enabling block option	Tunnel is down and block is on	Turn the block option off; reconnect
Works on the main profile, not in a second space	Separate VPN settings per space	Install the app inside that space
Menu names differ from a guide	Different Android version	Search Settings for VPN
Stopped working after an update	Permission or battery rule changed	Re-approve the prompt; review battery settings

If it still fails, the guide to troubleshooting a VPN on Android lists more steps.

A five-minute checklist before you travel

A short routine on the day before a trip catches most Pixel-specific problems while you still have a reliable home connection to fix them.

1. Install any pending system and app updates, then restart the phone once, so that nothing updates in the middle of a journey.
2. Open the VPN app, sign in if needed, and connect on home Wi-Fi to confirm the pass is active.
3. Open the gear menu and confirm that Always-on VPN is selected. Leave the block option off unless you have practised turning it off.
4. Check the battery setting for the app and make sure it is not restricted.
5. Connect on mobile data as well, because networks behave differently.
6. Note where the support page and your My Pass details are, so you are not searching for them with a poor connection.

This takes minutes and removes the most common surprises.

Limits and common mistakes

• Treating a Pixel as automatically safer. A phone with timely updates still needs good habits and a trustworthy VPN source.
• Creating a manual profile without values from an administrator.
• Turning on the block option and then being unable to open a hotel sign-in page.
• Assuming a VPN on the main profile covers Private Space or another user.
• Skipping a test after a major system update.
• Installing a VPN from a random file instead of the official store; VPN APK vs Play Store explains the risks.
• Expecting a VPN to stop phishing or malware. It protects the route, not your choices.

Summary

On a Google Pixel, a VPN app is the straightforward option and a manual profile is for work setups. Always-on VPN is worth enabling, the block option is worth understanding before you use it, Private DNS is best left on Automatic, and separate spaces need their own tests. After updates, recheck the battery setting and the connection.

If you want to try this on your own Pixel, the prepaid passes on the pricing page work with the free VPNclient app, and you only pay for the days you choose.