First launch

For the DNS build

These steps apply to the DNS foundation. Experimental Preview has different startup conditions; do not use single-app inspection to bypass a Preview configuration error.

1. Open NetScope and let the rules load. Resolve a rules error first: a visible app screen alone does not establish that filtering is ready.
2. Check your internet connection without NetScope. Note which VPN you currently use: starting another VPN service in that profile can stop it.
3. Enable protection. If Android shows a VPN consent prompt, approve only the build you chose. The VPN interface cannot be created without consent.
4. Wait for the active state. If an error appears, read it and open VPN will not connect.
5. Open a familiar site and inspect domain activity. Query counters describe DNS events, not speed or proof that every connection works.

What the VPN icon means

In the DNS build it indicates a local interface for name-query processing. It does not establish a remote tunnel for all traffic, an IP change or anonymity.

Stop protection using NetScope’s own control. Continue with connection scope.

System consent and VPN lifecycle — Android Developers.