For users who can already connect manually and want connections to start or stop automatically based on network conditions. First, distinguish On Demand from traffic routing. Then configure rules in this order: exclude a specific Wi-Fi network, connect on cellular, and add a fallback for other networks. Finally, verify domain conditions and learn how to turn the feature off completely. These steps focus on the system VPN On Demand feature on iPhone and iPad; menu paths may differ on other platforms.
1. Automatic connections vs. traffic routing
Shadowrocket’s On Demand feature controls when the system attempts to establish a VPN connection. Once connected, how traffic is handled depends on Global Routing and the active configuration. A VPN icon in the status bar does not mean all requests use a proxy, and a site matching DIRECT does not mean the system will disconnect the VPN.
There are two ways to get Shadowrocket: iPhone and iPad users pay a one-time $2.99 through the App Store. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. The Mac (Apple Silicon and Intel), Windows, Android, and Linux versions are free. Find download options for every platform on the all-platform download page. This guide assumes you already have your own service provider and subscription. The app does not include connectivity services, and this site does not provide, sell, or recommend nodes or subscriptions.
To route traffic by website, check Global Routing on Home, select Config, and confirm the intended configuration is active. Proxy, Direct, Config, and Scene are different routing modes, not On Demand connection actions. In particular, do not confuse Direct under Global Routing with Disconnect in a system On Demand rule: the former controls how requests are routed; the latter controls whether the tunnel connects.
2. Test a manual connection before enabling On Demand
Automation cannot fix incorrect connection settings. On Home, select a connection you already have, connect manually, and visit a known-working destination. If that fails, check the server address, port, authentication details, and protocol settings before enabling On Demand. Avoid changing the server, DNS, and routing rules at the same time; otherwise, you will not know which change caused the result.
- On Home, confirm the selected connection. If you imported it through a subscription, update it successfully first and make sure the configuration is not empty.
- Check that the protocol matches your existing server. Authentication and transport settings are not interchangeable between Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard.
- Connect manually and allow Shadowrocket to add a VPN configuration when prompted. Test access in a browser instead of relying on the connection switch alone.
- Go to Settings → On Demand. Note the current rules and their order before adding network conditions.
- Change and save one condition at a time. Return to Home to check the connection status, then perform an actual network switch.
3. Specific Wi-Fi networks: add exceptions before general rules
For example, to keep the VPN tunnel disconnected on your home Wi-Fi and connect on other Wi-Fi networks, first check the current network name in system Settings → Wi-Fi. An SSID is the Wi-Fi network name, not the router brand, gateway address, or device name. Replace Home-WiFi with the name shown on your device, checking every space, punctuation mark, and character.
In Shadowrocket, go to Settings → On Demand. In the editable Wi-Fi conditions, specify that SSID and set its action to Disconnect; then set Connect for other Wi-Fi networks. Available options can vary by system and platform. The cards below show how conditions correspond to actions; they are not configuration files you can paste or import. If your current interface does not offer a condition, do not try to replace it with a domain rule in Config.
Specific Wi-Fi exception
- Setting
- Settings → On Demand
- Network type
- Wi-Fi
- Example SSID
- Home-WiFi
- Action
- Disconnect
- Rule order
- Before the general condition for other Wi-Fi networks
Enter the actual SSID. Networks with the same name may match the same condition.
Other Wi-Fi networks
- Setting
- Settings → On Demand
- Network type
- Wi-Fi
- SSID restriction
- General condition with no specific SSID
- Action
- Connect
- Rule order
- After the specific SSID exception
Do not put the general condition before the exception; the specified network could match Connect first.
An SSID identifies a network by name; it does not tell you whether the network is trustworthy. Recheck the match scope if you rename your home router, give the two Wi-Fi bands separate names, or use a different name for a guest network. If public Wi-Fi requires a sign-in page, complete that step first. Connect cannot make a server reachable while the underlying network has no internet access.
4. Cellular networks: test the condition separately
To connect automatically when you leave Wi-Fi, you can set Connect for cellular networks. This condition checks the device’s current network interface, not the SIM card name or mobile carrier. An iPad can test this condition only if it has cellular capability and cellular data is enabled. A device using a phone’s hotspot is usually connected over Wi-Fi, so check the SSID instead.
- In Settings → On Demand, check the cellular network condition, set its action to Connect, and save your changes.
- Keep the Disconnect exception for your specified Wi-Fi network. Do not replace it with an unconditional Connect rule that overrides every case.
- In system Settings → Wi-Fi, turn Wi-Fi off and confirm that the device is actually using cellular data—not merely disconnected from the current network through Control Center.
- Load a new webpage and check the connection status on Home along with the result. System triggers may depend on network availability and new requests, so the icon at the instant you switch networks is not enough to confirm the outcome.
- Reconnect to the specified Home-WiFi network and visit your destination again to verify that the Disconnect exception works as expected.
5. Domain conditions: opening a website does not toggle the VPN globally
The system VPN On Demand feature can use actions such as EvaluateConnection to decide whether to connect based on domain resolution and reachability. This differs from connecting directly based on network type and does not read the browser’s address bar. Configure this behavior only if your current editor actually offers domain evaluation; do not assume every platform supports the same domain conditions.
Enter a hostname such as example.com, not https://example.com/path or a webpage title. The relevant field determines how domain evaluation matches; do not assume it works like DOMAIN-SUFFIX. If options such as “connect when resolution fails” or “connect when a probe fails” are available, configure them as needed and make sure the DNS service or probe target works on the networks you plan to use.
- Domain evaluation happens as the system handles relevant requests. DNS caching or an app reusing an existing connection may mean that reopening a page does not reproduce the initial trigger.
- Webpages load images, scripts, and other domains. A condition for the main page’s domain does not automatically cover all third-party requests.
- Closing a browser tab is not a reliable signal to disconnect the tunnel. Do not expect the VPN to disconnect immediately when you finish browsing.
- The trigger path may differ when an app handles DNS itself, uses encrypted DNS, or connects directly to an IP address. When testing, record system DNS resolution and app behavior separately.
If your goal is to proxy a specific website and connect directly everywhere else, it is usually better to keep the connection available and set up traffic routing in Config rather than repeatedly toggling the tunnel with domain conditions. The following shows routing syntax, not an On Demand configuration. PROXY must refer to a policy that is actually available in your active configuration.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTThese two lines match example.com and its subdomains to PROXY, with other requests falling through to DIRECT. They do not tell the system to disconnect the VPN when you leave the site, and they do not automatically cover other domains the site depends on. Check the actual destination and matched policy in the request log before deciding whether to add rules.
6. Resolve conflicts: check On Demand conditions and Config separately
On Demand connections and request routing are two separate decision processes, so check them independently. The system evaluates On Demand rules in order; the first applicable match determines the action. Config rules also depend on their order, but their matches are not the same thing. Moving DOMAIN-SUFFIX to the top of Config will not fix a Wi-Fi exception in the wrong position in the system’s On Demand list.
| Layer to check | Specific conflict | How to fix it |
|---|---|---|
| On Demand | A general Wi-Fi Connect rule comes before a Disconnect rule for a specific SSID | Move the specific SSID exception ahead of the general Wi-Fi condition, then switch networks again. |
| On Demand | An unconditional Connect rule matches first | Put specific network and domain evaluation conditions first, and broad fallback rules later. |
| Global Routing | Global Routing is set to Direct, but you expect a PROXY rule in Config to apply | Go back to Home, check the routing mode, select Config, and confirm the intended configuration is active. |
| Config | A broad rule comes before a specific domain rule | Check specific matches such as DOMAIN-SUFFIX first, followed by rules such as GEOIP and IP-CIDR, and then FINAL at the end. |
Do not treat FINAL as an On Demand fallback action. FINAL handles requests that do not match earlier routing rules; it cannot mean “connect automatically on other Wi-Fi networks.” Likewise, GEOIP and IP-CIDR match request addresses, not whether your device is on home Wi-Fi or cellular.
7. Troubleshoot with a test matrix, then turn off automatic connections
A useful test records the network before and after the trigger, the connection status, and the access result. Keep the destination constant and change one network condition at a time. Do not assume a rule failed just because an old connection briefly persists during a network switch. Check the connection status together with the destination’s request log.
| Test scenario | Expected result | Check first if it differs |
|---|---|---|
| Switch from another network to Home-WiFi | Disconnect according to the specific SSID rule | Actual SSID, rule order, and whether changes were saved |
| Switch from Home-WiFi to another Wi-Fi network | Connect according to the general Wi-Fi rule | Whether the general condition exists and any sign-in page was completed |
| Turn off Wi-Fi and use cellular data | Try to connect according to the cellular Connect condition | Cellular data permission, network reachability, and interface condition |
| Visit example.com after connecting | Handle the request according to the active Config policy | Global Routing mode, active configuration, and actual request domain |
Why does the VPN reconnect after I turn it off manually?
First, turn off On Demand in Settings → On Demand and save, then disconnect from Home. If the system still triggers a connection, open the details for the relevant configuration in iPhone or iPad system Settings → General → VPN & Device Management → VPN and check whether Connect On Demand is still enabled. The displayed name may vary by system language.
What if the VPN still shows as connected on my home Wi-Fi?
First, check the current SSID in system Wi-Fi settings. Then make sure the Disconnect rule for that SSID comes before the general Connect rule. Save your changes, switch to another network, and reconnect to the Wi-Fi. Also confirm that you are checking the VPN configuration used by Shadowrocket.
On Demand is enabled, but webpages still will not load. Why?
Temporarily turn off On Demand, connect manually from Home, and visit the same destination. If manual connection also fails, check the underlying network, server settings, and DNS first. If manual connection works but On Demand does not trigger, check the network conditions, rule order, and system On Demand switch.
Why does the VPN stay connected after I close a webpage?
Closing a webpage is not a general Disconnect condition for On Demand rules. To stop the connection, first turn off On Demand, then disconnect manually. If you only want other sites to connect directly, keep the tunnel up and use DIRECT routing in Config; do not use browser tab state to control the connection.
After troubleshooting, restore only the rules you need: a specific Wi-Fi exception, other Wi-Fi networks, cellular, and a fallback. You do not need to keep unused domain evaluation conditions. After adding each condition, repeat its test and confirm that both the connection action and request routing behave as expected before finishing setup.