diff --git a/app/src/main/java/eu/faircode/netguard/ServiceSinkhole.java b/app/src/main/java/eu/faircode/netguard/ServiceSinkhole.java
index 1d298cfc..653500d3 100644
--- a/app/src/main/java/eu/faircode/netguard/ServiceSinkhole.java
+++ b/app/src/main/java/eu/faircode/netguard/ServiceSinkhole.java
@@ -348,13 +348,15 @@ public class ServiceSinkhole extends VpnService implements SharedPreferences.OnS
             } catch (Throwable ex) {
                 Log.e(TAG, ex.toString() + "\n" + Log.getStackTraceString(ex));
 
-                showExitNotification(ex.toString());
-
-                if (!(ex instanceof IllegalStateException)) {
+                if (ex instanceof IllegalStateException)
+                    showErrorNotification(4, getString(R.string.msg_start_failed));
+                else {
                     // Disable firewall
                     prefs.edit().putBoolean("enabled", false).apply();
                     Widget.updateWidgets(ServiceSinkhole.this);
 
+                    showExitNotification(ex.toString());
+
                     // Report exception
                     Util.sendCrashReport(ex, ServiceSinkhole.this);
                 }
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 10dd8193..5b8ef1c0 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -140,6 +140,8 @@ however it is impossible to guarantee NetGuard will work correctly on every devi
     <string name="msg_disabled">NetGuard is disabled, use the switch above to enable NetGuard</string>
     <string name="msg_revoked">NetGuard has been disabled, likely by using another VPN based application</string>
     <string name="msg_error">NetGuard has been disabled, because of an internal error</string>
+    <string name="msg_start_failed">The Android VPN service could not be started, which is most likely caused by a bug in your Android version.
+Restarting your device or revoking the VPN permission using the Android settings from NetGuard might (temporarily) solve this problem.</string>
     <string name="msg_installed">\'%1$s\' installed</string>
     <string name="msg_access">%1$s attempted internet access</string>
     <string name="msg_completed">Action completed</string>