Contents

Docs

General
Provisioning
Work profile
Fully managed
App management
FAQ

Change log

Share this page

Is it possible to utilise multiple VPN connections within a profile?

Not concurrently, no. Android only permits a single active VpnService per user, which means a single work profile, personal profile, or fully managed device can host exactly one system-level VPN connection at a time.

Why only one?

#

Android's VPN framework is built around the VpnService class. When a VPN app calls establish(), the system installs its virtual network interface as the default route for that user. Starting a second VpnService does not add a parallel tunnel - it replaces the first. The displaced service receives onRevoke(), its interface is torn down, and the new one takes over.

If both VPN apps are configured to reconnect automatically (or if one is set as always-on VPN), the result is an endless disconnect-reconnect loop as each app tries to reclaim the interface. This is the single biggest source of "my VPN keeps dropping" reports when two clients are installed side by side.

Always-on makes it worse
Enabling always-on VPN on one client while another client is also running inside the same profile is guaranteed to cause flapping. Always-on explicitly re-establishes the connection whenever it is torn down, including when a second VPN revokes it.

What people actually mean by "multiple VPNs"

#

Most of the time, the underlying requirement isn't really two concurrent tunnels - it's selective routing, or separation between work and personal traffic. Android provides several mechanisms that cover the real use cases:

Per-app VPN (one tunnel, selective routing)

#

A single VPN client can route only specific apps through the tunnel while leaving others on the direct network, using VpnService.Builder.addAllowedApplication() or addDisallowedApplication(). These are mutually exclusive - allowlist or blocklist, never both.

Configuration is done through the VPN app's configurations, not directly through AMAPI or DPC policy. Check with your VPN vendor for managed config keys that accept allow/deny package lists.

This is the closest Android comes to "multiple VPN routing" within a single profile: one tunnel, different behaviour per app.

Split tunnelling (inside the VPN app)

#

Some enterprise VPN clients implement split tunnelling at the network layer - certain destinations go through the tunnel, everything else goes direct. This is handled by the VPN app's own routing logic and has no Android-level equivalent; capability varies by vendor.

App-embedded tunnels (not a VpnService)

#

An application can open its own TLS, QUIC, or proxy connection to a back-end without using VpnService at all. These connections are opaque to Android's VPN framework, so they do not conflict with a system VPN and can run alongside one. Browsers with built-in proxies, messaging apps with end-to-end transport, and some enterprise SDKs work this way. Only traffic generated by that app is affected.

Separate profiles for separate tunnels

#

The one-VPN-per-user rule is scoped to a single Android user. A device with a work profile, COPE personal side, or Private Space can run a different VPN in each scope concurrently because each is a distinct Android user. This is a real way to have "two VPNs running at once" - but it requires the traffic you want routed to originate from the corresponding profile.

See Is it possible to utilise a single VPN connection across the entire device? for how VPN scoping interacts with each deployment model.

What doesn't work

#
  • Two VPN apps in the same profile, both started - they will repeatedly revoke each other
  • Always-on on one client plus an ad-hoc connect on another - always-on wins, the other drops immediately
  • Trying to "chain" two VPNs at the OS level - Android has no nested VpnService concept. Chaining, if required, must be implemented inside a single VPN client
mail Reply by email | edit_note Edit this page | code_blocks Code

Docs

General
Provisioning
Work profile
Fully managed
App management
FAQ
Ask MIKA
MIKA Mobile Intelligence & Knowledge Assistant