Android App

The rVPN Android app creates a full-tunnel VPN connection using Android’s built-in VPN service. All device traffic is routed through an encrypted tunnel without requiring manual proxy configuration.

Requirements

• Android 15.0 or later (API 35+)
• A deployed rVPN server
• Your server address, and either a .rvpn profile export from another device or a prekey bundle from your server administrator

Install

Google Play (recommended)

Download from Google Play

Direct APK

curl -LO https://assets.rvpn.org/1.2.6/rvpn-android.apk

Then open the APK on your device to install it.

Add your first profile

The app is organised around profiles — each profile bundles a server address, identity key, prekey bundle, and split-tunnel rules. You can have up to 10 profiles and switch between them from the Home screen.

Open the app. On the Home screen, tap the profile card (“No active profile”), or go to the Settings tab → Manage Profiles.

You have two options:

Import an existing profile

If someone has shared a .rvpn file with you, tap the import icon. Pick the file. The profile lands in your list with all keys pre-populated.

Create a profile from scratch

Tap the + button. In the Profile editor, fill in:

• Name — anything you like (e.g. “Home HK”)
• Colour — a swatch to help you identify the profile at a glance
• Server Address — wss://your-server.com/api/v1/ws/tun
• Identity Key — tap Generate Identity to create a new X3DH identity for this profile
• Prekey Bundle — tap Import Prekey… and pick the JSON file your server administrator provided

The Identity Key and Prekey Bundle rows show a green checkmark once they’re present. Tap Save.

Connect

Back on the Home screen, tap the big Connect button. Android will prompt you to allow rVPN to establish a VPN connection the first time — approve it. The app will:

1. Connect to your server over TLS 1.3 WebSocket
2. Establish forward-secret encryption (X3DH + Double Ratchet)
3. Receive a tunnel IP address from the server
4. Route all traffic through the Android VPN interface

Once connected the Home screen shows your assigned IP, session uptime, and running sent/received byte counts. Tap the button again to disconnect.

Switch profiles

On the Home screen, tap the active profile card to open profile management. Tap another profile to make it active. If a tunnel is already up, the app will disconnect, switch, and reconnect using the new profile.

Split tunnel

Route only international traffic through the VPN while local traffic goes direct.

Open the Profile editor for the active profile (Settings → Manage Profiles → tap your profile). Under Traffic:

• Split Tunnel — turn it on
• Bypass Countries — pick one or more countries whose CIDR ranges will bypass the tunnel (built-in dropdown includes CN, US, GB, DE, FR, JP, KR, SG, HK, AU, CA, IN, BR, RU)
• Bypass Domains — extra domains to send direct
• Tunnel Domains — domains to force through the tunnel even when Split Tunnel is on

Save. The next connection uses the new rules.

DNS

By default, DNS is resolved through the tunnel. To use custom upstream resolvers, edit the profile → Network → DNS Servers and enter a comma-separated list (e.g. 1.1.1.1, 8.8.8.8).

Server identity (TOFU)

Trust on First Use is on by default per profile. The app accepts and pins the server’s identity on the first successful connection. Pins are written in the canonical ik:1:<base32> form and live on the profile itself.

If the server ever presents a different key, the app opens a Server identity changed dialog with the pinned and received pins side-by-side and three options: Cancel, Delete Profile, or Trust New Identity. If the operator rotated the key using the signed rotation ceremony, the app updates the pin silently — no dialog.

For stricter verification, paste the pin (from the operator, in ik:1: form) into the profile’s Server Fingerprint field before the first connect.

For the full model — pin format, rotation ceremony, threat model — see Server Identity Pinning.

Troubleshooting

”Failed to start VPN”

• Verify server address is correct and starts with wss://
• Verify the Identity Key row shows a green checkmark
• Verify the Prekey Bundle row shows a green checkmark
• Ensure another VPN is not already active on the device
• Verify your server is reachable on port 443

”No IP assigned”

The server’s IP pool is exhausted. Contact your server administrator to widen the DHCP range in rvpn.toml.

Split tunnel not working

• Verify Split Tunnel is on in the profile editor
• Verify the Bypass Country code (e.g. CN, not China)
• Toggle Airplane mode to refresh the routing table

Slow connection

• Try different DNS servers
• Check server load
• Verify Split Tunnel isn’t sending too much traffic direct

For more troubleshooting help, see the Troubleshooting Guide.