diff --git a/api/current.txt b/api/current.txt
index 38e032086f10c..0d67271debf2f 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -16850,6 +16850,7 @@ package android.net {
     method public android.net.VpnService.Builder addRoute(java.net.InetAddress, int);
     method public android.net.VpnService.Builder addRoute(java.lang.String, int);
     method public android.net.VpnService.Builder addSearchDomain(java.lang.String);
+    method public android.net.VpnService.Builder allowBypass();
     method public android.net.VpnService.Builder allowFamily(int);
     method public android.os.ParcelFileDescriptor establish();
     method public android.net.VpnService.Builder setConfigureIntent(android.app.PendingIntent);
diff --git a/core/java/android/net/VpnService.java b/core/java/android/net/VpnService.java
index 680b8f26d2a4b..5d61de22e9aca 100644
--- a/core/java/android/net/VpnService.java
+++ b/core/java/android/net/VpnService.java
@@ -552,6 +552,21 @@ public class VpnService extends Service {
             return this;
         }
 
+        /**
+         * Allows all apps to bypass this VPN connection.
+         *
+         * By default, all traffic from apps is forwarded through the VPN interface and it is not
+         * possible for apps to side-step the VPN. If this method is called, apps may use methods
+         * such as {@link ConnectivityManager#setProcessDefaultNetwork} to instead send/receive
+         * directly over the underlying network or any other network they have permissions for.
+         *
+         * @return this {@link Builder} object to facilitate chaining of method calls.
+         */
+        public Builder allowBypass() {
+            // TODO
+            return this;
+        }
+
         /**
          * Create a VPN interface using the parameters supplied to this
          * builder. The interface works on IP packets, and a file descriptor