Manual VPN setup — Android
Recommended: the VPN Pink app
Start with our VPN Pink app for your device. Manual setup is an alternative if the app cannot be used or you prefer your own VPN client.
Get the VPN Pink app →These instructions are an alternative to our recommended VPN Pink app. Choose your platform.
Before you start
You need an active VPN entitlement. Use only a server assigned to your account. Signing into the website does not itself activate VPN access.
Find your VPN username, VPN password and assigned server in My Dashboard. The VPN password may differ from your website password. A customer reference is not your VPN username.
IKEv2 / IPsec
| Server address | Example: Germany — Choose a server address: hostname or IP Hostname: de-fkb-sha-vps3.vpn-pink.comAlternative IPv4: 212.227.45.10Alternative IPv6: 2a01:239:304:6900::1 |
|---|---|
| Server Identity / Remote ID | vpn-pink.com |
| VPN username | My Dashboard → |
| VPN password | My Dashboard → |
Leave Client Identity / Local ID empty. If your client requires it, use your VPN username.
Leave the server certificate file unselected to use the trusted system CAs. Keep certificate validation enabled; do not install an arbitrary certificate.
Setup steps
- Open Settings and search for VPN. Add a profile if your device offers IKEv2/IPsec MSCHAPv2. Menu labels vary by manufacturer and Android version.
- Enter your assigned server and VPN credentials. If a server/remote identity field is available, use vpn-pink.com. Do not choose PSK/shared-secret or certificate-based client authentication.
- If the built-in client does not support this setup, use the official strongSwan VPN Client with IKEv2 EAP (Username/Password), or follow the WireGuard guide. Save, grant the system VPN permission and connect.
Choose a server address: hostname or IP
Enter exactly one value in Server address: the hostname or, alternatively, the IPv4 or IPv6 address of the same assigned server. If DNS fails, replace the hostname with its fixed IP. IPv6 requires working IPv6 connectivity. If the client has a separate Remote ID field, keep vpn-pink.com there. A fixed IP bypasses DNS lookup of the server address, but does not replace certificate validation.
| VPN | Hostname | Alternative IPv4 | Alternative IPv6 |
|---|---|---|---|
| AT | at-sha-vps1.vpn-pink.com | 5.132.162.69 | 2a03:3180:4001:106::473d:989b |
| DE | de-fkb-sha-vps3.vpn-pink.com | 212.227.45.10 | 2a01:239:304:6900::1 |
| ES | es-mad-sha-vps1.vpn-pink.com | 82.223.83.18 | 2001:ba0:253:6000::1 |
| US | us-sha-vps1.vpn-pink.com | 198.71.58.244 | 2607:f1c0:f04f:f200::1 |
If connection fails
IKEv2 uses UDP 500 and 4500. Replies must be allowed; home-router port forwarding is normally unnecessary. No captured packets is not proof that a port is blocked.
An EAP_NAK followed by EAP_FAILURE means the EAP negotiation was rejected; it does not prove a wrong password. “Recovery remains armed” is an app status, not an administrator-permission request or proof of a working VPN. Ask support with the time, platform, server and log.
Do not share passwords, private keys, tokens, QR codes or complete WireGuard configurations. Review logs before sharing.
Contact support →VPN
Check that your system reports the tunnel connected, internet access works and your public IP has changed. Opening the app or importing a profile alone proves no connection.
IP →