WireGuard on Android: Complete Setup Guide (2026)

WireGuard is the fastest, simplest VPN protocol to run on a phone — once it is set up, connecting is a single toggle, and it sips battery compared with older protocols. This guide walks through WireGuard on Android end to end in 2026: installing the app, importing your server config, enabling a kill switch, per-app split tunneling, and fixing the handshake and MTU issues people hit. It works with any WireGuard server — PiVPN, NetBird, or a manual setup.

Step 1 — Install the app

Install the official WireGuard app from the Play Store or F-Droid (open-source build). Avoid third-party "WireGuard" clones.

Step 2 — Import your server config

In the app, tap + and choose one of:

• Scan from QR code — fastest and least error-prone. Your server renders the client config as a QR (pivpn -qr, NetBird's app, or qrencode on a manual setup).
• Import from file — copy the .conf to the phone and select it.
• Create from scratch — paste keys and the [Peer] endpoint manually.

WireGuard is the client half; it needs a server endpoint. If you do not have one, a Contabo VPS at €4.99/month runs a personal WireGuard server comfortably.

Step 3 — Connect and verify

Toggle the tunnel on. Check the latest handshake updates (not "never") and that your public IP changes. For the protocol background, see WireGuard vs OpenVPN.

Step 4 — Enable a kill switch (always-on)

Android has this built in: Settings > Network & internet > VPN > (gear next to WireGuard) → enable Always-on VPN and Block connections without VPN. Now the phone never leaks traffic outside the tunnel if WireGuard drops — the Android equivalent of a kill switch.

Step 5 — Per-app split tunneling

Edit the tunnel → Applications → Exclude apps (everything tunnels except those — useful for a banking app) or Include only chosen apps. Built into the client, no extra software.

Troubleshooting

• No handshake (stays "never"): wrong Endpoint IP/port, server UDP port not open in its firewall, or a mismatched public key. Verify the server is listening and reachable.
• Connects but no internet: lower the MTU (e.g. 1280) in the interface config — fixes many mobile-network MTU issues.
• Drops on screen-off: disable battery optimisation for the WireGuard app.
• DNS leaks: set the tunnel's DNS to your server or a trusted resolver, then test with our DNS-leak guidance.

For reusable client/server templates, see WireGuard config templates.

The bottom line

WireGuard on Android is a five-minute setup: install the official app, import your server config by QR, toggle on, and enable always-on + block-without-VPN for a kill switch. Add per-app split tunneling as needed, and keep the MTU trick in your back pocket for flaky mobile networks. You just need a WireGuard server to point it at — a Contabo VPS or a home Raspberry Pi does the job.

Editorial guide based on the documented behaviour of the official WireGuard Android client and Android's always-on VPN features. Security depends on your server configuration and key hygiene. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.