Guide
How to make a VPN connect automatically
The settings that make the tunnel come up without being asked: at login, on any network you have not marked as trusted, and on mobile data. Which of them each platform has, what a trusted network actually grants, and the gap none of them closes on its own. Written against the clients of late 2026.
What this settles
A VPN you have to remember to turn on is off exactly when it matters: on the network you joined in a hurry. The settings below make connecting the default and disconnecting the exception, so that a forgotten client is a connected one. Why the public network is the case that matters is on the public Wi-Fi page; this page is the switches.
Four of them, in the order to set them, then the two platforms that do it at the system level rather than in the app.
1. Start with the system
- Turn on launch at login in the client's general settings. On Windows the same entry appears under startup applications; on macOS under login items. Either place works, and the client's own is easier to find again.
- Turn on connect on launch, which is almost always a separate switch under it and off by default. A client that starts and waits is a tray icon, not a tunnel.
- Restart and watch the order. The browser that reopens its tabs, the mail client, the chat application — all of them start too, and whatever starts before the tunnel talks on the open network. That gap is the subject of the last section.
2. Connect on networks you have not approved
- Find the auto-connect rule, usually offered as a choice between always, on untrusted networks, and never. Choose always if the client offers it; choose untrusted networks only if you intend to maintain the list.
- Include mobile data. It is often a separate switch in the same group, off on the assumption that the operator's network is private. The operator reads it, and so does whoever the operator answers to.
- Set the default location the automatic connection uses, if the client lets you. Otherwise it picks, and the country it picks can change between networks.
3. The trusted list
A trusted network is one where the client stays off. The client will offer to add the current network to the list, usually at home, and the offer reads as a convenience. What it grants is that on that network the router, the internet provider behind it and anyone else connected see your traffic as if the client were not installed. That can be the right call for a network you run and nobody else uses; it is a decision, and the default is an empty list.
- Open the trusted networks list and read what is on it. Clients add entries on a prompt that is easy to accept without reading.
- Remove any network you do not administer yourself — an office, a relative's house, a café you visit often. Familiar is not the same as trusted.
- Note that a trusted network is matched by name. A public network that happens to share the name is trusted too, which is the strongest argument for a short list.
On iOS: Connect On Demand
iOS lets a VPN rule live in the system rather than the app: once the client has installed its configuration, the on-demand switch under the VPN's settings tells the system to bring the tunnel up whenever a network is in use, before any app asks for it. The rule survives the client being closed, which the client's own auto-connect does not. Turn it on in the client where it is offered, and confirm the toggle under the system's VPN settings reads on; the same device setting covers Wi-Fi and cellular unless the client's rule narrows it.
On Android: Always-on
Android's equivalent sits in the system settings for the VPN, not in the client: Always-on VPN restarts the tunnel whenever the device has a network, including after a reboot and after the client is killed, and Block connections without VPN beneath it holds traffic until the tunnel is up. Turn on both. Together they are the automatic connection and the closed gap in one place, enforced by the system rather than promised by the app; the Android guide has the path to the setting.
4. The gap before it connects
Every setting above brings the tunnel up soon after the network is. Soon is not immediately, and in the seconds between, anything that starts with the system talks on the open connection. Closing the gap is the kill switch's job, specifically the mode that applies at system start rather than only while the client is connected; the client's settings call it permanent, always, or at boot. Turn that mode on, then confirm the whole arrangement by testing the kill switch, including the restart described there. A client that connects automatically and holds the gap closed is one you can stop thinking about, which is the point of the page.
When it does not connect by itself
It starts with the system but does not connect
Starting and connecting are two settings in most clients, and only the first is on by default. Open the client's general or startup settings and look for a second entry, usually worded as connect on launch or connect automatically, under the one that launches it at login.
If both are on and it still sits idle, the client may be waiting for a network it considers untrusted; a home network on the trusted list keeps it disconnected there by design.
It connects on Wi-Fi and not on mobile data
Mobile data is usually a separate rule. Clients that connect on untrusted Wi-Fi treat the mobile network as a third category, with its own switch, and some leave it off on the assumption that the operator's network is private. It is not private from the operator. Find the mobile-data entry in the auto-connect settings and turn it on; on iOS the on-demand rule can name cellular explicitly.
It reconnects to a server I did not choose
The automatic connection uses a default — the fastest, the nearest, the last used — set separately from the server you pick by hand. Look for a default or preferred location in the auto-connect settings and set it there. A changing exit is not a fault in itself, but a changing country is a surprise worth removing.
The home network keeps asking to be trusted
Say no, or say it once and understand what you said. A trusted network is one where the client stays off, which means everything on it — the router, the internet provider behind it, anyone else connected — sees your traffic as if the client were not installed. That is a reasonable decision for a network you run yourself and nobody else's. The prompt is the client offering you the exception; it is not advice.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.