diff --git a/packages/VpnDialogs/AndroidManifest.xml b/packages/VpnDialogs/AndroidManifest.xml
index 08257b63a7ff1..a3d27ce8a3dab 100644
--- a/packages/VpnDialogs/AndroidManifest.xml
+++ b/packages/VpnDialogs/AndroidManifest.xml
@@ -20,6 +20,7 @@
         package="com.android.vpndialogs">
 
     <uses-permission android:name="android.permission.CONTROL_VPN" />
+    <uses-permission android:name="android.permission.CONNECTIVITY_INTERNAL" />
 
     <application android:label="VpnDialogs"
             android:allowBackup="false" >
diff --git a/packages/VpnDialogs/src/com/android/vpndialogs/ConfirmDialog.java b/packages/VpnDialogs/src/com/android/vpndialogs/ConfirmDialog.java
index badc31e6df922..72ce9c4efdc06 100644
--- a/packages/VpnDialogs/src/com/android/vpndialogs/ConfirmDialog.java
+++ b/packages/VpnDialogs/src/com/android/vpndialogs/ConfirmDialog.java
@@ -60,6 +60,12 @@ public class ConfirmDialog extends AlertActivity
             finish();
             return;
         }
+        final String alwaysOnVpnPackage = getAlwaysOnVpnPackage();
+        // Can't prepare new vpn app when another vpn is always-on
+        if (alwaysOnVpnPackage != null && !alwaysOnVpnPackage.equals(mPackage)) {
+            finish();
+            return;
+        }
         View view = View.inflate(this, R.layout.confirm, null);
         ((TextView) view.findViewById(R.id.warning)).setText(
                 Html.fromHtml(getString(R.string.warning, getVpnLabel()),
@@ -76,6 +82,16 @@ public class ConfirmDialog extends AlertActivity
         button.setFilterTouchesWhenObscured(true);
     }
 
+    private String getAlwaysOnVpnPackage() {
+        try {
+           return mService.getAlwaysOnVpnPackage(UserHandle.myUserId());
+        } catch (RemoteException e) {
+            Log.e(TAG, "fail to call getAlwaysOnVpnPackage", e);
+            // Fallback to null to show the dialog
+            return null;
+        }
+    }
+
     private boolean prepareVpn() {
         try {
             return mService.prepareVpn(mPackage, null, UserHandle.myUserId());