Use platform controls carefully
On Android, working profiles can be paired with the system’s Always-on VPN and Block connections without VPN controls. Validate the behavior on your actual device rather than trusting a cosmetic toggle.
Test the real network
After configuring a gateway, deliberately make it unavailable and verify the intended traffic behavior. Reconnect, switch networks and check DNS/IPv6 handling before relying on the VPN.