On Demand determines when the system establishes or disconnects a VPN tunnel. Global Routing and Config determine how requests are handled once the tunnel is up. This guide is for users who can already connect manually and have their own service details and subscription. Set Wi-Fi and cellular conditions first, understand the limits of domain evaluation, then verify everything in a consistent order. This keeps automatic connections, traffic routing, and service availability distinct.
1. On Demand vs. traffic routing rules
Shadowrocket’s On Demand feature lets Apple’s system manage connections as needed; it does not choose a connection setting again for every webpage. Network interfaces and Wi-Fi SSIDs help determine whether a tunnel is needed. Once a request enters the tunnel, Global Routing, the active Config, and the selected connection configuration determine where it goes. An automatic connection succeeding does not mean every request is routed through a proxy.
For example, On Demand may keep the VPN connected while Global Routing is set to Direct, so requests still use a direct connection. To apply custom rules, check that Global Routing is set to Config. Proxy sets the overall routing mode, while Scene concerns scene selection; neither replaces Wi-Fi or cellular trigger conditions.
Bottom line: Connect manually once before adding automatic conditions
On Home, select an existing connection configuration, connect manually, and confirm that the destination is reachable. If this test fails, check the service settings, DNS, and Config first. Don’t use additional On Demand rules to mask a connection problem.
2. Settings → On Demand: Save a baseline before enabling conditions
Before you begin, note the selected connection configuration on Home, the Global Routing mode, and the active Config. If you already have a subscription, confirm that it imported and updated successfully and that the connection configuration is still valid. On Demand does not update subscriptions or fix expired credentials. If an update changes the configuration name or selection, test the connection again.
- Test a manual connection on Home. The first time you connect, follow the system prompt to allow adding a VPN configuration.
- Go to Settings → On Demand and review the existing conditions. Note their current order first; don’t add a set of rules with conflicting actions without checking how they interact.
- Start with one easy-to-check network condition, such as a specific Wi-Fi SSID. Change only that condition, save it, and then enable On Demand.
- In your iPhone or iPad’s system settings, search for VPN and open the Shadowrocket configuration details. Check the Connect On Demand status. The path may vary with the system interface, so use the settings shown on your device.
- Change networks, check the VPN status, and then start a new request. System evaluation and tunnel setup take time, so avoid rapidly toggling the connection.
The configuration cards below illustrate condition design. They are not screenshots or ready-to-import configurations. Connect and Disconnect indicate connection actions; the conditions you can edit depend on what appears under Settings → On Demand.
3. Use SSIDs to distinguish Wi-Fi networks; configure cellular separately
An SSID is the name of a Wi-Fi network, not the router’s admin address or your device’s local IP address. Match the actual name, including capitalization, spaces, and symbols. If your home uses separate names for two bands, such as HomeNet and HomeNet-5G, include each name in the intended conditions. Don’t treat part of a name as a wildcard for every network.
Wi-Fi exception for a specific SSID
- Location
- Settings → On Demand
- Interface condition
- Wi-Fi
- Example SSID
- HomeNet
- Action
- Disconnect
- Rule order
- Before the general Wi-Fi connection condition
Use this only if you specifically want the tunnel to stay disconnected on that network. An SSID alone does not establish that a network is trusted.
Cellular connection condition
- Location
- Settings → On Demand
- Interface condition
- Cellular
- SSID restriction
- None
- Action
- Connect
- How to test
- Turn off Wi-Fi and start a new request
Cellular networks don’t have Wi-Fi SSIDs. Don’t add your home network name to a cellular condition.
If you want the tunnel disconnected on a specific home Wi-Fi network but connected on other Wi-Fi networks and cellular, distinguish the specific SSID exception from the general Wi-Fi condition. Don’t assume that adding only a home-network exception automatically gives every other network the opposite action; other behavior still depends on the following conditions and existing configuration.
- Networks with the same name: The same SSID can be used at different locations. A name match does not verify the router’s identity.
- Combined bands: If two frequency bands share an SSID, a name-based condition generally can’t distinguish between them.
- Networks requiring sign-in: For Wi-Fi that requires a web login, complete network authentication before checking the tunnel and access.
- Interface changes: A weak Wi-Fi signal can cause the active interface to change. Check which network the device is actually using, not just whether Wi-Fi is turned on.
4. Domain triggers aren’t DOMAIN-SUFFIX rules or disconnect-on-close
Domain-based On Demand requires distinguishing system connection evaluation from in-app traffic routing. Apple’s On Demand mechanism supports evaluating matching domains through EvaluateConnection—for example, to establish a connection when conditions require it. Whether the current Shadowrocket On Demand editor offers domain conditions, available actions, or DNS evaluation options depends on what appears in the app; don’t assume every field supported by the system is available in its interface.
If the editor offers domain evaluation, enter a domain rather than a full URL. For example, use example.com, not https://example.com/path. Some evaluations depend on a resolution failure or reachability check, so visiting the domain won’t necessarily trigger a connection every time. An existing tunnel, DNS cache, and reused connections can also affect what you observe. Test domain triggers separately, without an earlier rule that connects on all networks.
| What it configures | What it does | What it does not mean |
|---|---|---|
| On Demand domain evaluation | Whether the system needs to establish a connection for a matching request | Closing a webpage immediately disconnects the entire VPN |
DOMAIN-SUFFIX | Choose a request policy by domain suffix in Config | Adding a rule alone starts a tunnel that is not connected |
DIRECT | Connect matching requests directly to their destination | Disconnect the entire active VPN tunnel |
FINAL | Handle requests that did not match earlier rules | Provide a fallback action for On Demand network conditions |
To proxy specific domains and send everything else direct, handle this primarily in Config rather than trying to make the system connect and disconnect for every domain. The following rule snippet is an example for the rules section of your current configuration. PROXY must map to a valid policy; the example domain does not indicate an available service.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTNot triggering a connection for a domain does not force an existing connection to disconnect. A tunnel may carry requests from multiple apps, so opening or closing one webpage does not define the tunnel’s entire lifecycle.
5. Rule order: Put specific exceptions before general conditions
The system checks On Demand rules in order and uses the first matching rule. Conditions such as interface and SSID within a single rule must all be met. A list of SSIDs specifies the network names that can match. When troubleshooting, don’t just confirm that a rule exists—check whether a broader condition earlier in the list takes precedence.
- First: Specific exceptions. For example, set the interface to Wi-Fi and the SSID to HomeNet, with the action Disconnect.
- Second: General Wi-Fi. Set Connect for other Wi-Fi networks where you want a connection. If this rule comes first, the home-network exception may never run.
- Third: Cellular. Set a separate action for Cellular, without adding an SSID condition that applies only to Wi-Fi.
- Finally: Check everything else. Review existing general conditions and make sure no broad Connect or Disconnect rule conflicts with your goal.
This order applies to network-rule design. If you add EvaluateConnection, check whether an earlier rule already matches the current network. “First match” in On Demand and “first match” in Config rules occur at different stages: moving FINAL won’t fix the order of SSID conditions, and moving an SSID condition won’t change the request policy in DOMAIN-SUFFIX.
6. Check four network states; don’t rely on a single icon change
Keep the existing service, Global Routing, and Config unchanged during testing; change only the network conditions. After each change, wait for the status to settle, then start a new request. An existing webpage may show cached content, and an existing long-lived connection may not immediately reflect a new route. The table shows expected results for the example setup, not test results for any particular network.
| Test state | Expected result | Check first if it differs |
|---|---|---|
| Connect to HomeNet | The specific SSID Disconnect rule matches | SSID spelling, exception order, and whether the configuration was saved |
| Connect to another Wi-Fi network | The general Wi-Fi Connect rule matches | Whether a general condition exists and whether the network has been authenticated |
| Turn off Wi-Fi and use cellular | The Cellular Connect rule matches | Active interface, cellular access permissions, and connection configuration validity |
| Temporarily turn off On Demand | Automatic triggers from these conditions stop | Connect On Demand status in system settings |
To pause automatic connections, turn off On Demand first. If needed, manually disconnect the existing tunnel and check the system configuration. Turning off the connection on Home alone may not prevent the system from establishing a tunnel again the next time a condition is met. If you won’t use a set of automatic conditions for a while, note them and disable or remove the relevant rules; this is more predictable than repeatedly disconnecting manually.
7. Common issues: Automatic reconnects, unreachable websites, and domain triggers
Why does it reconnect after I disconnect manually?
Go to Settings → On Demand and check whether the current network still matches a Connect condition. If you only want to pause connections temporarily, turn off On Demand, confirm the Connect On Demand status in the system VPN configuration, and then disconnect the existing connection. Don’t just keep toggling the connection on Home.
Why does it still connect automatically when I set Disconnect for my home Wi-Fi?
Check the actual SSID on the system’s Wi-Fi screen, including spaces, capitalization, and the name used by the other frequency band. Then move the specific SSID exception before the general Wi-Fi condition. After saving the conditions, reconnect to that Wi-Fi network. Don’t mistake a tunnel left over from before the change for the result of the new rule.
The VPN shows as connected, but webpages won’t load. Should I keep changing On Demand?
Pause the automatic conditions and connect manually first. Check that the existing service selected on Home is valid, then review Global Routing and the active Config. A delay result does not confirm that DNS resolution or a webpage request succeeded. If manual connection also fails, troubleshoot the service settings, DNS, and request policy.
Why doesn’t adding DOMAIN-SUFFIX connect automatically when I visit the domain?
DOMAIN-SUFFIX is a traffic-routing rule in Config; it does not start a tunnel that is not already connected. First, check under Settings → On Demand whether the relevant connection evaluation condition is available and enabled. Then check whether an earlier matching rule takes precedence. If you only want that domain to use PROXY, keep the tunnel connected while testing the routing rule.
After setup, assess two things separately: whether a network change establishes or disconnects the tunnel as expected, and whether requests are routed as expected once the tunnel is up. Record each result to determine whether to adjust On Demand, Global Routing, Config, or the existing service settings.