diff --git a/apps/rego-tunnel/shared/cisco-vpn b/apps/rego-tunnel/shared/cisco-vpn
index e8fd388..508981e 100755
--- a/apps/rego-tunnel/shared/cisco-vpn
+++ b/apps/rego-tunnel/shared/cisco-vpn
@@ -568,6 +568,85 @@ auto_login() {
     log INFO "Auto-login sequence completed"
 }
 
+# Watchdog - monitors VPN and reconnects if dropped
+start_watchdog() {
+    log INFO "Starting VPN watchdog (check every 60s, keepalive ping every 5min)..."
+
+    local check_interval=60
+    local keepalive_interval=300
+    local last_keepalive=0
+    local reconnect_attempts=0
+    local max_reconnect_attempts=3
+
+    while true; do
+        sleep $check_interval
+
+        local now=$(date +%s)
+        local vpn_iface=$(get_vpn_interface)
+
+        if [ -n "$vpn_iface" ]; then
+            # VPN is up
+            reconnect_attempts=0
+
+            # Keepalive ping every 5 minutes to prevent idle timeout
+            if [ $((now - last_keepalive)) -ge $keepalive_interval ]; then
+                if ping -c 1 -W 5 "$TARGET_IP" &>/dev/null; then
+                    log DEBUG "Keepalive ping to $TARGET_IP successful"
+                else
+                    log WARN "Keepalive ping to $TARGET_IP failed (VPN may be degraded)"
+                fi
+                last_keepalive=$now
+            fi
+        else
+            # VPN is down
+            ((reconnect_attempts++))
+            log WARN "VPN disconnected! Reconnect attempt $reconnect_attempts/$max_reconnect_attempts..."
+
+            if [ $reconnect_attempts -le $max_reconnect_attempts ]; then
+                # Kill stale processes and restart
+                kill_cisco_processes "true"
+                sleep 2
+
+                # Start vpnagentd
+                if ! pgrep -x vpnagentd >/dev/null; then
+                    /opt/cisco/secureclient/bin/vpnagentd &
+                    sleep 5
+                fi
+
+                # Start vpnui
+                export GDK_BACKEND=x11
+                export WEBKIT_DISABLE_DMABUF_RENDERER=1
+                /opt/cisco/secureclient/bin/vpnui &
+                sleep 3
+
+                # Run auto-login
+                auto_login &
+
+                # Wait for connection
+                local wait_count=0
+                while [ -z "$(get_vpn_interface)" ] && [ $wait_count -lt 120 ]; do
+                    sleep 2
+                    ((wait_count+=2))
+                done
+
+                if [ -n "$(get_vpn_interface)" ]; then
+                    log INFO "VPN reconnected successfully!"
+                    setup_forwarding
+                    reconnect_attempts=0
+                else
+                    log ERROR "Reconnect attempt $reconnect_attempts failed"
+                fi
+            else
+                log ERROR "Max reconnect attempts reached. Manual intervention required."
+                log ERROR "Use menu option 1 to restart VPN manually."
+                # Reset counter after a longer wait
+                sleep 300
+                reconnect_attempts=0
+            fi
+        fi
+    done
+}
+
 # Start Cisco AnyConnect with logging
 start_anyconnect() {
     local do_auto_login="$1"
@@ -650,17 +729,18 @@ start_anyconnect() {
         log WARN "Connection test: ${RED}FAILED${NC} (may need manual route on Windows)"
     fi
 
-    # Start background monitor for auto-reconnect
-    (
-        while true; do
-            sleep 30
-            if [ -z "$(get_vpn_interface)" ]; then
-                log WARN "VPN disconnected! Will reconnect on next menu action..."
-            fi
-        done
-    ) &
-
     log INFO "VPN setup complete"
+
+    # Disable screen blanking/power saving
+    xset s off 2>/dev/null || true
+    xset -dpms 2>/dev/null || true
+    xset s noblank 2>/dev/null || true
+    log DEBUG "Screen blanking disabled"
+
+    # Start watchdog in background
+    start_watchdog &
+    WATCHDOG_PID=$!
+    log DEBUG "Watchdog started with PID $WATCHDOG_PID"
     return 0
 }
 
diff --git a/apps/rego-tunnel/shared/xstartup b/apps/rego-tunnel/shared/xstartup
index 0723e3a..a5afd96 100644
--- a/apps/rego-tunnel/shared/xstartup
+++ b/apps/rego-tunnel/shared/xstartup
@@ -25,6 +25,11 @@ export WEBKIT_DISABLE_DMABUF_RENDERER=1
 openbox &
 sleep 2
 
+# Disable screen blanking and power saving
+xset s off 2>/dev/null || true
+xset -dpms 2>/dev/null || true
+xset s noblank 2>/dev/null || true
+
 # Make script executable and launch in terminal
 chmod +x /shared/cisco-vpn 2>/dev/null || true
 xterm -fa 'Monospace' -fs 11 -bg black -fg white -geometry 130x45+10+10 \