On Demand controls when the system tries to establish or disconnect a VPN connection; it does not decide which route each request takes. This guide is for users who can already connect manually and have their own connection details: distinguish network conditions from domain evaluation, test Wi-Fi, cellular, and domain conditions in order, then check that automatic reconnection and routing behave as expected.
On Demand vs. Global Routing
Shadowrocket’s On Demand settings control when a connection is made. Find them under Settings → On Demand. The system handles connection requests according to saved VPN On Demand rules, so closing the app does not turn On Demand off. After a manual disconnect, the system may connect again if a trigger condition still applies.
Global Routing controls how traffic is routed after a connection is established. Proxy, Direct, Config, Scene, and On Demand are separate settings: Config routes traffic according to the active configuration; Proxy and Direct apply their respective global routing modes. Scene involves choosing a scene, so check its related settings separately. When troubleshooting auto-connect, avoid changing the routing mode at the same time.
For example, a VPN may connect automatically while a webpage still uses Direct. That does not necessarily mean On Demand has failed. Check the connection status in Home first, then review Global Routing and the matching Config rules. Conversely, having a DOMAIN-SUFFIX rule in Config does not mean the system will establish a tunnel automatically for that domain.
Before you start: establish a working manual connection
On Demand cannot fix incorrect connection details. First, use the existing connection details in Home to connect manually and confirm that you can reach the intended site. Then set up automatic triggers. If you already have a subscription, importing or updating it manages your connection details; On Demand does not update subscriptions or correct outdated server addresses, passwords, or ports.
- In Home, check the selected connection and run Connectivity Test. A response only confirms reachability under that test’s conditions; verify with an actual request as well.
- Keep Global Routing unchanged. To test existing routing rules, select Config and confirm that the intended configuration is active in Config.
- Connect manually and approve the system VPN configuration prompt. If the system is still waiting for confirmation, complete authorization before testing auto-connect.
- Note the current network name, connection status, and test site. Don’t update a subscription, change the selected connection, and modify DNS in the same test run.
- Go to Settings → On Demand and review the existing conditions. Start with a single network condition, confirm the result, then add exceptions.
Wi-Fi conditions: network type vs. a specific SSID
“On Wi-Fi” and “connected to a specific Wi-Fi network” cover different scopes. The first applies to all Wi-Fi networks; the second matches a specific SSID. An SSID is the wireless network name—not the router’s admin address or your device’s current IP address. When entering a specific name, match the system display, including spaces, capitalization, and symbols. Don’t rely on a remembered abbreviation.
In Settings → On Demand, review the Wi-Fi conditions and their actions. If the current interface offers a specific SSID condition, add the networks you need to distinguish. Connect requests a connection when the condition matches; Disconnect requests a disconnection. These actions control VPN status—they do not mean that every site on that Wi-Fi network uses Proxy or Direct.
- Connect on every Wi-Fi network: Start by testing a Connect condition that covers Wi-Fi; there’s no need to enter each SSID separately.
- Exclude a particular Wi-Fi network: Set that SSID to Disconnect and check whether a broader Connect condition matches first.
- Networks with the same name: Identical SSIDs don’t prove that devices are connected to the same access point. Don’t treat a name match as network authentication.
- Guest networks with a sign-in page: Complete the web-based authentication required by the system first. Auto-connect may keep failing if Wi-Fi is connected but internet access hasn’t been granted.
The system evaluates On Demand rules in order, so place specific conditions before broader ones. If the current interface doesn’t let you reorder them, check how the generated conditions overlap and remove duplicate entries with conflicting actions. After saving, leave the Wi-Fi network and reconnect to test whether the network change triggers the expected action; this is more reliable than repeatedly toggling settings on the same screen.
Cellular conditions: test separately from Wi-Fi
A cellular condition matches the network interface the device is actually using—not whether the status bar shows signal or whether a SIM is enabled. If Wi-Fi is still carrying traffic, turning on cellular data does not prove that the cellular condition is active. For a meaningful test, disconnect Wi-Fi in system settings, confirm the device is using cellular data, then check the connection status.
Option 1: Connect on both network types
- Condition
- Settings → On Demand
- Wi-Fi
- Connect
- Cellular
- Connect
- When to use
- The VPN should stay connected on both network types
This describes a combination of actions. Switching interfaces may still briefly re-establish the tunnel; it does not guarantee an uninterrupted connection.
Option 2: Exclude a specific Wi-Fi network
- Specific SSID
- Disconnect
- Other Wi-Fi networks
- Connect
- Cellular
- Connect
- What to check
- The specific SSID condition takes precedence over the broader Wi-Fi condition
Set conditions and actions as shown in the current interface. Whether to stay connected on a particular network depends on your needs.
These options are not statements about battery use. Cellular signal strength, retry frequency, background requests, and actual traffic all affect battery consumption. If the cellular condition is set to Connect but the selected connection is unreachable on that network, the system may keep retrying the tunnel. First disable automatic triggers and test the connection manually on the same cellular network; then decide whether to keep the condition.
- On Wi-Fi, record the expected action and actual status.
- Disconnect Wi-Fi in system settings. Once cellular data is available, record the same two details.
- Reconnect to the original Wi-Fi network and check whether the specific SSID exception takes effect again.
- If the connection drops only while switching and then recovers, the interface transition is the likely cause. If it stays in the wrong state, check for overlapping conditions and connection reachability.
Domain conditions: don’t move routing rules into On Demand
Domain-based On Demand evaluation works differently from matching Wi-Fi or cellular interfaces. The system’s Evaluate Connection mechanism can use domains and DNS resolution conditions to decide whether a connection is needed; common behavior includes attempting to connect to the VPN when resolution fails. This does not mean “connect unconditionally whenever any app accesses this domain,” nor does it inspect each HTTPS page address.
Only enter a domain if the current On Demand interface explicitly provides a domain evaluation field, and follow its instructions. Don’t paste Config rule lines into the domain field. For example, example.com is usually the domain value; https://example.com/path is not. Check the field’s description for subdomain matching behavior—don’t assume it works exactly like DOMAIN-SUFFIX.
| Item | Layer | What it decides |
|---|---|---|
| Wi-Fi / cellular conditions | On Demand network matching | Applies the corresponding connection action based on the interface, SSID, and other conditions |
| Evaluate Connection | System On Demand evaluation | Decides whether to connect based on configured domain and DNS conditions |
DOMAIN-SUFFIX,example.com,PROXY | Config routing rules | Matching requests for the relevant domain use the PROXY policy |
FINAL,DIRECT | Config final rule | Uses DIRECT when no earlier rule matches; it does not disconnect the tunnel |
Before testing domain evaluation, rule out a broader Connect condition that is already keeping the tunnel up. Browser and DNS caches, encrypted DNS built into an app, and reused connections can all prevent the expected system DNS lookup from occurring. So “I reopened the webpage and saw no VPN status change” is not enough to prove the rule is ineffective. Record the tunnel status, network, and DNS conditions before testing.
Repeated connections or no trigger: narrow down the cause
First distinguish between a connection that repeatedly changes state and one that stays connected while requests fail. For the first, check automatic connection conditions, interface changes, and tunnel establishment failures. For the second, check Global Routing, Config, DNS, and connection details. Changing settings for both symptoms at once can break On Demand rules that were working correctly.
Why does the connection turn back on soon after I disconnect it in Home?
Go to Settings → On Demand and pause automatic connections, then return to Home and disconnect. If it stays disconnected, a matching condition was previously requesting Connect. Check the current Wi-Fi, specific SSID, and cellular conditions one by one instead of repeatedly tapping the connection switch.
Why does it stay connected when I set my home Wi-Fi to Disconnect?
Check the current SSID against the name shown in system settings. Make sure you haven’t joined a guest network or another network name on the same router. Then check whether a broader Wi-Fi Connect condition matches first. Save your changes and reconnect to the network to test.
The connection keeps failing after switching to cellular. What should I change?
Temporarily turn off On Demand. On the same cellular network, connect manually from Home and run Connectivity Test. If the manual connection also fails, check your existing connection details, network reachability, and system time first. Automatic triggers cannot bypass these requirements.
Why doesn’t entering a domain trigger an automatic connection when I open a webpage?
Make sure the domain is in the On Demand domain evaluation field, not Config. Then check the action and DNS conditions; cached results or another DNS resolution method may prevent the same evaluation from occurring. If you need domain-based routing, review the DOMAIN-SUFFIX rule in Config instead.
What should I do if I removed the system VPN configuration and On Demand stopped working?
Return to Shadowrocket, connect manually, and approve adding the VPN configuration again. Then check that Settings → On Demand is enabled. Also verify the VPN On Demand status in system settings. Don’t test automatic triggers until authorization is complete.
Before keeping your settings: complete an end-to-end check
A reliable setup doesn’t need more conditions; each condition needs a clear scope and a repeatable result. Test Wi-Fi and cellular interfaces first, add specific SSID exceptions next, and evaluate domain conditions last. Change one setting at a time and record the network, expected action, and actual status. This makes it easier to tell a matching problem from a connection failure.
- Check condition overlap: Specific SSID exceptions and broad Wi-Fi conditions don’t override each other unexpectedly, and the same network doesn’t have duplicate entries with opposing actions.
- Check routing: Global Routing in Home matches your needs, and you’ve checked the rule order and final FINAL rule in Config.
- Check recovery: Switch from Wi-Fi to cellular and back to Wi-Fi; both results match your expectations.
- Check how to turn it off: Know how to pause automatic triggers in Settings → On Demand before disconnecting manually.
- Check after changes: After updating an existing subscription or changing the selected connection, retest both manual connections and automatic triggers. Don’t rely on old test results.
Shadowrocket is a paid client for Apple platforms, primarily used on iPhone and iPad. Compatibility and system requirements for Mac, Apple TV, and Apple Vision are as listed on the App Store page. A one-time app purchase does not include a service plan. Check the validity of your connection details separately; this site does not provide, sell, or recommend nodes, subscriptions, or providers.