Android App

The rVPN Android app creates a full-tunnel VPN connection using Android’s built-in VPN service. All device traffic is routed through an encrypted tunnel without requiring manual proxy configuration.

Requirements

• Android 15.0 or later (API 35+)
• A deployed rVPN server
• Your server address, and either a .rvpn profile export from another device or a prekey bundle from your server administrator

Install

Google Play (recommended)

Download from Google Play

Direct APK

curl -LO https://assets.rvpn.org/1.2.6/rvpn-android.apk

Then open the APK on your device to install it.

Add your first profile

The app is organised around profiles — each profile bundles a server address, identity key, prekey bundle, and split-tunnel rules. You can have up to 10 profiles and switch between them from the Home screen.

Open the app. On the Home screen, tap the profile card (“No active profile”), or go to the Settings tab → Manage Profiles.

You have two options:

Import an existing profile

If someone has shared a .rvpn file with you, tap the import icon. Pick the file. The profile lands in your list with all keys pre-populated.

Create a profile from scratch

Tap the + button. In the Profile editor, fill in:

• Name — anything you like (e.g. “Home HK”)
• Colour — a swatch to help you identify the profile at a glance
• Server Address — wss://your-server.com/api/v1/ws/tun
• Identity Key — tap Generate Identity to create a new X3DH identity for this profile
• Prekey Bundle — tap Import Prekey… and pick the JSON file your server administrator provided

The Identity Key and Prekey Bundle rows show a green checkmark once they’re present. Tap Save.

Connect

Back on the Home screen, tap the big Connect button. Android will prompt you to allow rVPN to establish a VPN connection the first time — approve it. The app will:

1. Connect to your server over TLS 1.3 WebSocket
2. Establish forward-secret encryption (X3DH + Double Ratchet)
3. Receive a tunnel IP address from the server
4. Route all traffic through the Android VPN interface

Once connected the Home screen shows your assigned IP, session uptime, and running sent/received byte counts. Tap the button again to disconnect.

Switch profiles

On the Home screen, tap the active profile card to open profile management. Tap another profile to make it active. If a tunnel is already up, the app will disconnect, switch, and reconnect using the new profile.

Split tunnel

Route only international traffic through the VPN while local traffic goes direct.

Open the Profile editor for the active profile (Settings → Manage Profiles → tap your profile). Under Traffic:

• Split Tunnel — turn it on
• Bypass Countries — pick one or more countries whose CIDR ranges will bypass the tunnel (built-in dropdown includes CN, US, GB, DE, FR, JP, KR, SG, HK, AU, CA, IN, BR, RU)
• Bypass Domains — extra domains to send direct
• Tunnel Domains — domains to force through the tunnel even when Split Tunnel is on

Save. The next connection uses the new rules.

Multi-server routing (exit servers)

(App v1.2.9 and later.)

A profile can route traffic for specific domains or IP ranges out through other rVPN servers while everything else uses the profile’s own (primary) server. Typical use case: default all traffic through Hong Kong, but send google.com through a US exit so geolocated content resolves on the US side. Every exit must be a reachable rVPN server — traffic stays end-to-end encrypted through each of them.

Add an exit server

Exit servers come from your other existing profiles — there’s no manual server entry. Open the Profile editor for the active profile → Exit Servers → Add Exit Server, and pick the profile whose server you want to use. The server address, pinned TOFU fingerprint, and prekey bundle are seeded from that profile, and the exit gets a name derived from the profile name. Each exit keeps its own server identity pin, independent of the profile’s own pin.

Set routes

Each exit has Route Domains and Route IPs:

• A bare domain is a suffix match: google.com routes google.com and every subdomain; *.google.com matches subdomains only. Two-letter TLDs and short domains work fine.
• IPs accept CIDRs (e.g. 1.1.1.0/24).

When a routed domain resolves, the tunnel learns the answer’s addresses into an ip→exit map (kept for the answer’s TTL), so later connections to those IPs take the same exit. Static CIDR rules match directly. Everything else goes to the primary server.

Routed traffic never silently falls back to the primary exit: if an exit server is down, its routed traffic fails rather than leaking to another exit. Extra exits start lazily on first routed use and reconnect independently — the app’s displayed tunnel state always reflects the primary server.

Rules load when the tunnel starts — after editing exit servers or routes, disconnect and reconnect.

DNS and export/import

Each exit resolves DNS over HTTPS through its own tunnel, so routed domains get answers local to that exit (no geo-DNS surprises).

Profile export/import carries the whole multi-server config. Prekey bundles for exits are embedded when you export with the identity key; exports made by older app versions import cleanly with an empty exit list.

The CLI client has a separate, TOML-based multi-server pool (SOCKS5-only) since v1.3.3 — see Client Configuration Reference. It shares no configuration with this feature.

DNS

By default, DNS is resolved through the tunnel. To use custom upstream resolvers, edit the profile → Network → DNS Servers and enter a comma-separated list (e.g. 1.1.1.1, 8.8.8.8).

Server identity (TOFU)

Trust on First Use is on by default per profile. The app accepts and pins the server’s identity on the first successful connection. Pins are written in the canonical ik:1:<base32> form and live on the profile itself.

If the server ever presents a different key, the app opens a Server identity changed dialog with the pinned and received pins side-by-side and three options: Cancel, Delete Profile, or Trust New Identity. If the operator rotated the key using the signed rotation ceremony, the app updates the pin silently — no dialog.

For stricter verification, paste the pin (from the operator, in ik:1: form) into the profile’s Server Fingerprint field before the first connect.

For the full model — pin format, rotation ceremony, threat model — see Server Identity Pinning.

Troubleshooting

”Failed to start VPN”

• Verify server address is correct and starts with wss://
• Verify the Identity Key row shows a green checkmark
• Verify the Prekey Bundle row shows a green checkmark
• Ensure another VPN is not already active on the device
• Verify your server is reachable on port 443

”No IP assigned”

The server’s IP pool is exhausted. Contact your server administrator to widen the DHCP range in rvpn.toml.

Split tunnel not working

• Verify Split Tunnel is on in the profile editor
• Verify the Bypass Country code (e.g. CN, not China)
• Toggle Airplane mode to refresh the routing table

Slow connection

• Try different DNS servers
• Check server load
• Verify Split Tunnel isn’t sending too much traffic direct

For more troubleshooting help, see the Troubleshooting Guide.