On Demand determines when the system establishes or disconnects a VPN connection. Rules determine how requests are routed after the connection is established. This guide is for iPhone and iPad users with a working configuration. It covers where to check Settings → On Demand, how to arrange Wi-Fi and cellular conditions, the limits of domain triggers, and how to return to manual control after disabling automatic connection. Test the connection manually first, then change one network condition at a time.
1. Understand the difference between On Demand, Global Routing, and Rules
On Demand is a system-managed connection policy, not a proxy routing rule. First, confirm in Home that your existing connection configuration works manually. Then open Settings → On Demand to review automatic connection settings. If a manual connection fails, adding automatic triggers will not fix an incorrect server address, authentication details, or network reachability.
Global Routing determines the routing mode for a connection. Proxy, Direct, and Config select proxying, direct connections, and rule-based routing, respectively. Scene organizes selections for a particular context; it does not represent a single fixed route. To troubleshoot automatic connections, keep Config selected and confirm which file is active in Config. Avoid changing scenes and On Demand conditions at the same time.
An active VPN connection does not mean every request goes through a proxy. A DIRECT rule in Config can send matching requests directly while On Demand remains connected. Conversely, FINAL,PROXY cannot establish a tunnel on its own if one is not already active. When troubleshooting, track the system connection status separately from the policy matched by each request.
2. Establish a manual connection baseline first
Start with a manual test you can repeat. Before making changes, note the current configuration name, Global Routing selection, and On Demand status. Available options vary by version; do not assume that every system-supported On Demand policy appears as a control on the current screen.
- In Home, select your existing connection configuration and connect manually. Visit a known working destination and confirm that the request succeeds.
- Open Config and confirm which configuration file is active. To test routing, keep Global Routing set to Config and do not switch rule files.
- Open Settings → On Demand and check the master switch and existing conditions. For the first test, add just one condition rather than stacking several exceptions.
- Follow any system prompt to save or update the VPN configuration. Then go to the system Settings → General → VPN & Device Management and check the current VPN configuration and Connect On Demand status. The exact system menu path may vary by OS version.
- Return to Home to check the connection status, then perform an actual network change. Leaving the settings screen alone does not verify that a trigger works.
3. Set conditions for Wi-Fi networks and cellular data
Arrange network conditions with specific exceptions first and broader conditions afterward. On Demand evaluates rules in order, so an earlier match may prevent later conditions from being evaluated. For example, if you want to avoid automatic connections on your home Wi-Fi but connect on other networks, put the exception for that Wi-Fi before broader network conditions.
Use the actual Wi-Fi SSID, not the router model or a device label. Check the name in system Settings → Wi-Fi, then verify the matching condition in Settings → On Demand. If two access points use the same SSID, a name-based condition usually cannot distinguish them. A matching network name also does not prove that the network is trusted.
Exception for a specific Wi-Fi network
- Where to check
- Settings → On Demand
- What it matches
- The Wi-Fi network's actual SSID, such as Home-WiFi
- Action
- Disconnect, only if the corresponding action is available in the interface
- Rule order
- Place it before general conditions that cover all Wi-Fi networks
Home-WiFi is just an example. When saving, use the SSID currently shown on your device.
Connection condition for cellular data
- Where to check
- Settings → On Demand
- What it matches
- Cellular network condition; use the options shown on the page
- Action
- Connect, only if the corresponding action is available in the interface
- How to test
- Turn off Wi-Fi, confirm cellular data is available, and make a new request
Confirm the device supports cellular data before testing. This test does not apply to Wi-Fi-only iPad models.
Distinguish between a network that is not yet available and an On Demand rule that has not matched. After switching from Wi-Fi to cellular, confirm that the system has a data connection, then check the VPN status and visit a destination. If public Wi-Fi requires web-based sign-in, complete that first; repeatedly changing On Demand settings will not replace network authentication.
- Test the specified Wi-Fi: connect to that SSID, note whether the VPN disconnects or stays connected as expected, then make a new request.
- Test another Wi-Fi network: connect to a different SSID and check whether a broad Wi-Fi condition matches unexpectedly.
- Test cellular data: turn off Wi-Fi, confirm cellular is available, and check the connection action. Then reconnect to Wi-Fi and test the exception again.
- If the current screen only offers a simplified switch and no per-condition editing, do not look for fields that are not there. Configure only the options actually provided.
4. Domain triggers are not the same as DOMAIN-SUFFIX routing
A domain trigger asks whether a connection should be established when a domain is accessed. DOMAIN-SUFFIX determines which policy applies to requests that reach rule processing. Adding a domain to a Rule in Config does not create a system-level On Demand condition, so adding a suffix rule alone cannot guarantee that a connection starts while disconnected.
The system's On Demand domain evaluation can be expressed through EvaluateConnection and its associated connection rules. It may use DNS resolution or reachability checks to determine whether to establish a connection. This is not a simple switch that triggers for every request to a domain. Configure domain evaluation only if the current Shadowrocket screen provides an option for it; system policy names do not necessarily correspond to fixed in-app menu items.
| Setting or keyword | What it handles | What to check |
|---|---|---|
| On Demand domain condition | On Demand evaluation before a connection is established | Whether the screen provides this option, the evaluation action, and DNS and reachability conditions |
DOMAIN-SUFFIX | Requests matching a domain suffix | Whether the domain is correct and an earlier rule overrides the match |
GEOIP | Geographic classification of the destination IP | IP classification and rule order in the active configuration |
IP-CIDR | A specified IPv4 address range | Network address, subnet mask, and target policy |
FINAL | Requests that did not match an earlier rule | Whether the fallback policy is appropriate |
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXYThis snippet illustrates routing order only. It is not a complete configuration or an On Demand settings file. example.com and its subdomains match the first rule; subsequent requests are checked against the address range and GEOIP rules, and unmatched requests fall through to FINAL. PROXY must refer to an existing, working proxy policy. Pasting this example does not configure a connection.
- On a regular network connection, check that the test domain resolves and note the current connection status.
- If the screen offers an On Demand domain condition, save it, return the device to a disconnected state, and then make a new request to the test domain.
- Check separately whether a VPN connection is established, whether the request succeeds, and which Rule it matches after connecting. Do not treat these as a single result.
- If DNS caching, an existing persistent connection, or browser caching affects the result, make a new test request. Do not conclude that no trigger occurred simply because an already-open page still displays.
5. Troubleshoot automatic reconnections and rule conflicts in order
When something goes wrong, identify which layer is failing before changing settings. If no connection starts automatically, check the On Demand switch and conditions. If the connection is established but a destination fails, check the existing connection configuration, DNS, and routing. Avoid updating a subscription, switching protocols, changing Global Routing, and rewriting On Demand conditions all at once; otherwise, it will be difficult to tell which change affected the result.
Why does it reconnect after I turn it off in Home?
First, pause automatic connection in Settings → On Demand, then disconnect manually. Turning off the connection switch in Home may leave active On Demand conditions in place, allowing the system to reconnect after the next network event or request. Then check Connect On Demand in the system VPN configuration.
Why does the connection stay active when I return to my home Wi-Fi?
Check the actual SSID first, then make sure the exception for that Wi-Fi appears before any general Wi-Fi condition. Also distinguish Disconnect from Ignore: Disconnect requests a disconnection, while Ignore does not necessarily force an existing connection to disconnect. Available actions depend on what the screen offers.
Why doesn't it connect as soon as I switch to cellular data?
Turn off Wi-Fi, confirm cellular data is available, then make a new request and check the system VPN status. Verify that the cellular condition is enabled and that no earlier condition matches. If a manual connection also fails, return to Home and check the existing configuration rather than adding more automatic rules.
The VPN is connected. Why is traffic still going DIRECT?
Check Global Routing in Home, then review the matching order of the current Rules in Config. Direct mode or an earlier matching DIRECT rule could explain this behavior. Changing On Demand will not automatically change an established routing policy to PROXY.
Test connection protocols separately from trigger conditions. If an existing configuration uses Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard, its protocol settings determine how the connection is established; On Demand still determines when to request a connection. If the trigger works but the handshake fails, check the address, port, and authentication fields required by that configuration instead of assuming the Wi-Fi name did not match.
6. Return to manual use after turning off On Demand
Disabling automatic triggers does not necessarily disconnect an active VPN, and it does not switch routing to Direct. Turn off the relevant automatic conditions in Settings → On Demand and save, then check the system VPN configuration. To stop the current connection, return to Home and disconnect manually. Connections can then be started manually; check Global Routing and the Rules in Config separately.
- Note the original condition order and current configuration name so you can restore them later. Do not rush to delete connection entries that still work.
- Turn off On Demand and check Connect On Demand in the current VPN configuration to make sure no automatic conditions remain active.
- Disconnect manually in Home. Test one Wi-Fi change and one new network request, and check whether a connection still starts automatically.
- If it still reconnects automatically, check whether another VPN configuration or a device management policy is controlling the connection. Repeatedly toggling the Home switch is not a reliable fix.
- To resume using the VPN, connect manually and confirm Global Routing. If you re-enable On Demand, restore conditions one at a time, starting with a single condition.