Speed without safety is a trap. Here’s how to lock down your phone so it’s fast and private.

Goals

Always-on protection (untrusted Wi-Fi auto-connect + kill switch)
Fast protocol (WireGuard by default; fallbacks for blocked networks)
Private DNS (no hotel/router hijacks)
No surprises (split tunneling for picky apps)

iOS (iPhone/iPad)

1) Install & sign in
Get your VPN from the App Store and approve the VPN configuration.
Apple guide: https://support.apple.com/guide/iphone/use-a-vpn-iph7c3d96bab/

2) Protocol
Start with WireGuard. If blocked, try IKEv2; last resort OpenVPN (TCP) for restrictive networks.

3) Auto-connect & kill switch
Enable Auto-Connect on Untrusted Wi-Fi and Kill Switch (may be labeled “Block internet without VPN”).

4) Private DNS
Most reputable VPNs use in-tunnel DNS by default. Confirm in the app (look for “Prevent DNS leaks”).
Verify at https://www.dnsleaktest.com/.

5) Split tunneling
Per-app bypass is managed by the VPN app on iOS. Exclude only what you must (e.g., specific streaming/banking apps).

6) Browser privacy
Use HTTPS-Only where available. Consider Brave or Firefox Focus for quick private sessions.
Brave WebRTC controls: https://support.brave.com/hc/en-us/articles/360058973371-How-do-I-prevent-WebRTC-leakage

Android (9+)

1) Install & sign in from the Play Store.

2) Always-on + Block without VPN
Settings → Network & Internet → VPN → gear icon → toggle Always-on VPN and Block connections without VPN.
Google help: https://support.google.com/android/answer/9070925?hl=en

3) Protocol
Choose WireGuard first; if blocked, OpenVPN (UDP); then OpenVPN (TCP).

4) Private DNS (system DoT)
Settings → Network & Internet → Private DNS → “Private DNS provider hostname” (e.g., dns.quad9.net or your VPN’s).
Guide: https://support.google.com/android/answer/9081830?hl=en
Note: When the VPN is connected, its DNS usually takes precedence.

5) Split tunneling
Exclude individual apps (casting, banking, LAN devices) in the VPN app.

6) Battery & stability
Allow the VPN app to run in background; don’t let aggressive battery savers kill it.
If roaming causes drops, enable seamless handover/roaming in the app (if offered).

Speed tips that don’t sacrifice safety

Pick a nearby server.
Prefer WireGuard.
Consider MTU ~1280–1420 if your app supports it (advanced).
If an app misbehaves, split-tunnel just that app (understand the trade-off).

Quick verification (2 minutes)

Check IP & WebRTC: https://ipleak.net/ and https://browserleaks.com/webrtc
Check DNS: https://www.dnsleaktest.com/ (should show your VPN/Private DNS)
Toggle Wi-Fi ↔ LTE; ensure the VPN auto-reconnects without leaks.

Bottom line

With Always-on + Kill Switch + Private DNS and a modern protocol, your phone is locked down for 99% of situations—without giving up speed.

Useful links

WireGuard: https://www.wireguard.com/
OpenVPN: https://openvpn.net/
Android Always-on: https://support.google.com/android/answer/9070925?hl=en
DNS leak test: https://www.dnsleaktest.com/
WebRTC leak check: https://browserleaks.com/webrtc

Fast, Secure Mobile Setup: iOS & Android in 10 Minutes