WireGuard on Android: Complete Setup Guide (2026)

WireGuard is the fastest, simplest VPN protocol to run on a phone - once it is set up, connecting is a single toggle, and it sips battery compared with older protocols. This guide walks through WireGuard on Android end to end in 2026: installing the app, importing your server config, enabling a kill switch, per-app split tunneling, and fixing the handshake and MTU issues people hit. It works with any WireGuard server - PiVPN, NetBird, or a manual setup.

What you need before you start

• An Android phone or tablet on Android 10 or later (older versions work, but the always-on/kill-switch toggles are cleanest on recent releases).
• A running WireGuard server with a reachable public endpoint - a home Raspberry Pi with a forwarded UDP port, or a small VPS. The Android app is only the client.
• The client config for this device - a QR code on screen or a .conf file. Give each device its own key pair; reusing one config across phones breaks the handshake because two peers then share a public key.

Step 1 - Install the app

Install the official WireGuard app from the Play Store or F-Droid (open-source build). Avoid third-party "WireGuard" clones.

Play Store or F-Droid?

Both ship the same official client. The Play Store build updates automatically and is fine for most people. The F-Droid build is compiled from source by F-Droid, carries no Google dependencies, and suits a de-Googled phone - the trade-off is that updates arrive a little slower. Either is trustworthy; just avoid look-alike apps from unknown publishers, since a VPN client handles all your traffic.

Step 2 - Import your server config

In the app, tap + and choose one of:

• Scan from QR code - fastest and least error-prone. Your server renders the client config as a QR (pivpn -qr, NetBird's app, or qrencode on a manual setup).
• Import from file - copy the .conf to the phone and select it.
• Create from scratch - paste keys and the [Peer] endpoint manually.

WireGuard is the client half; it needs a server endpoint. If you do not have one, a Contabo VPS at €5.50/month runs a personal WireGuard server comfortably.

Step 3 - Connect and verify

Toggle the tunnel on. Check the latest handshake updates (not "never") and that your public IP changes. For the protocol background, see WireGuard vs OpenVPN.

Step 4 - Enable a kill switch (always-on)

Android has this built in: Settings > Network & internet > VPN > (gear next to WireGuard) → enable Always-on VPN and Block connections without VPN. Now the phone never leaks traffic outside the tunnel if WireGuard drops - the Android equivalent of a kill switch.

Step 5 - Per-app split tunneling

Edit the tunnel → Applications → Exclude apps (everything tunnels except those - useful for a banking app) or Include only chosen apps. Built into the client, no extra software.

Network-level routing: Allowed IPs

Per-app split tunneling (Step 5) decides which apps use the tunnel. AllowedIPs in the [Peer] config decides which destinations do - and the two combine:

• 0.0.0.0/0, ::/0 routes all IPv4 and IPv6 through your server - the full-tunnel default you want for privacy on public Wi-Fi.
• A narrow range like 10.0.0.0/24 sends only your home/office subnet through the tunnel, leaving the rest of your traffic on the normal connection - perfect for reaching a home NAS or Pi-hole without slowing everything down.

If you run a full tunnel but still want to print or cast at home, the cleanest route is to keep those devices on the LAN and use per-app exclusion for the casting app, since the Android client doesn't have iOS's "exclude private IPs" toggle.

Troubleshooting

• No handshake (stays "never"): wrong Endpoint IP/port, server UDP port not open in its firewall, or a mismatched public key. Verify the server is listening and reachable.
• Connects but no internet: lower the MTU (e.g. 1280) in the interface config - fixes many mobile-network MTU issues.
• Drops on screen-off: disable battery optimisation for the WireGuard app (Settings → Apps → WireGuard → Battery → Unrestricted).
• DNS leaks: set the tunnel's DNS to your server or a trusted resolver, then test with our DNS-leak guidance.
• "Always-on" greyed out: Android only allows always-on once a tunnel imports cleanly and connects at least once - connect manually first, then set it.
• Reconnects slowly after switching Wi-Fi↔mobile: add PersistentKeepalive = 25 to the [Peer] so the tunnel keeps the path alive across network changes and behind NAT.

For reusable client/server templates, see WireGuard config templates.

The bottom line

WireGuard on Android is a five-minute setup: install the official app, import your server config by QR, toggle on, and enable always-on + block-without-VPN for a kill switch. Add per-app split tunneling as needed, and keep the MTU trick in your back pocket for flaky mobile networks. You just need a WireGuard server to point it at - a Contabo VPS or a home Raspberry Pi does the job.

Editorial guide based on the documented behaviour of the official WireGuard Android client and Android's always-on VPN features. Security depends on your server configuration and key hygiene. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.