This guide is for iPhone and iPad users who can already connect manually and want connections to start or stop automatically based on network conditions. First, understand the difference between On Demand and Global Routing. Then configure Wi-Fi, cellular, and domain conditions, and verify the results by switching networks and reviewing request logs. These steps assume you already have your own provider and subscription.
1. On Demand controls when to connect, not how each request is routed
Shadowrocket uses the system VPN On Demand feature to connect or disconnect when specified conditions are met. It controls when a connection starts. Once connected, the route used by traffic still depends on Global Routing and the active configuration. A VPN-connected status does not mean every request passes through a proxy server.
Go to Settings → On Demand. Select servers in Home and configure rules in Config. Keeping these three roles separate makes troubleshooting easier and prevents unnecessary changes to routing rules when automatic connections fail. The available options depend on the app interface and system support.
How to diagnose: check the connection first, then the route
If no VPN connection is established, check the On Demand conditions first. If the VPN is connected but traffic takes the wrong route, check Global Routing and the matching policy. Keep these two issues separate.
2. Test a manual connection before setup
Automation depends on a working connection. On Demand cannot fix an incorrect server address, authentication details, or an expired subscription. Temporarily turn off On Demand, connect manually on the same network, and then start adding conditions.
- Open Home and confirm that your existing subscription is imported. If it needs updating, update it first, then check that the server you want to use is still listed.
- Tap the circle beside the server you want and confirm it is selected by default. Opening the server details alone does not select it.
- Turn on the connection switch at the top of Home. When connecting for the first time, allow the VPN configuration when prompted by the system.
- Run Connectivity Test and open an HTTPS page you know is reachable. If the test fails, resolve the manual connection issue first.
- Open Config and confirm which configuration is active. Then check Global Routing; to route traffic by rules, select Config.
- Keep the working configuration and existing On Demand conditions. Then go to Settings → On Demand and change one item at a time.
3. Wi-Fi: connect or disconnect by SSID
A Wi-Fi name usually means the SSID, not the router’s admin address or your device name. Check the current name in your system Wi-Fi settings before entering it in the corresponding On Demand condition. Match spaces, capitalization, and characters exactly; don’t add wildcards.
For example, to disconnect automatically on your home network and connect on other Wi-Fi networks, start by matching your specific home SSID, then handle other Wi-Fi networks. The table below describes the intended behavior and how to verify it; it is not configuration syntax to paste into Config. Action names and editable fields may vary by interface.
| Match | Action | How to verify |
|---|---|---|
| Specific SSID, such as Home-WiFi | Disconnect | Join this Wi-Fi network and check whether the VPN status matches your expectations |
| Other Wi-Fi networks | Connect | Switch to another available Wi-Fi network and check whether Shadowrocket connects automatically |
| Public Wi-Fi that requires sign-in | Complete network authentication first | Confirm the system sign-in page opens before testing On Demand |
- Go to Settings → On Demand, find the Wi-Fi condition, and start with one specific SSID.
- Choose whether to connect or disconnect for that SSID. If the interface lets you order conditions, put the specific SSID before broader Wi-Fi conditions.
- Save and enable On Demand. Leave the Wi-Fi network and rejoin it to observe an actual network change, rather than repeatedly reopening a page while staying on the same network.
- Once this condition behaves as expected, add conditions for other Wi-Fi networks.
An SSID identifies a network name, not whether the network is trustworthy. Different locations can use the same Wi-Fi name. Set automatic disconnection only when you understand the network environment; don’t lower your connection requirements just because a name looks familiar.
4. Cellular: test separately from Wi-Fi conditions
Cellular conditions only apply to devices with cellular connectivity. Adding this condition will not give a Wi-Fi-only iPad cellular access. During testing, make sure the system is actually using cellular data so a Wi-Fi connection doesn’t skew the result.
- In Settings → On Demand, set the desired connection action for cellular networks. Leave the verified Wi-Fi conditions unchanged while testing.
- Turn off Wi-Fi in system settings and confirm cellular data is available. Wait for the network switch to complete, then check the VPN status.
- Open a new HTTPS page and run Connectivity Test if needed. An already-open page may be cached, so don’t use it as your only test.
- Turn Wi-Fi back on, join a configured network, and check whether its corresponding action runs.
- If you have automatic reconnection or other automation settings enabled, review what each one does to avoid multiple mechanisms competing over the connection state.
5. Domain conditions: connection triggers are not DOMAIN-SUFFIX rules
Domain-based On Demand conditions evaluate the system’s need to resolve a domain; they do not inspect the full URL of every webpage. Available domain conditions, evaluation actions, and additional checks depend on the fields currently offered in Settings → On Demand. Don’t paste Config rule lines into a domain field.
The system may evaluate a domain using DNS resolution, a specified DNS server, or probe results to decide whether to connect. Adding a domain does not necessarily create a new VPN connection every time you visit it. An existing connection, DNS cache, or an app’s own resolution method can all affect what you observe.
| Where to configure | What to enter | Purpose |
|---|---|---|
| Domain condition in Settings → On Demand | A domain, such as example.com | Let the system evaluate whether to establish a connection |
| DOMAIN in Config | DOMAIN,example.com,DIRECT | Choose a request policy for an exact domain |
| DOMAIN-SUFFIX in Config | DOMAIN-SUFFIX,example.com,DIRECT | Choose a request policy for a domain and its subdomains |
- Choose a real domain that you’re authorized to access and have a clear reason to use. The example.com entry in the table only illustrates the format.
- Enter the domain itself in the domain field. Don’t include
https://, a path, port, or query parameters. - Set the condition using the evaluation options available in the interface. If there is no domain field, don’t use routing rules to imitate a connection trigger.
- Before testing, make sure the VPN hasn’t already connected due to another Wi-Fi or cellular condition. Then start a new visit to the domain.
- Record whether the VPN connected, whether the domain resolved, and whether the request succeeded. If something fails, check each of these three steps in turn.
Visiting an IP address directly usually can’t verify a domain trigger. The browser may use a cached address, or an app may use its own encrypted DNS, bypassing the expected system domain evaluation. For reliable network-based auto-connect, verify Wi-Fi or cellular conditions first, then add a domain condition.
6. Conflicting rules: check condition precedence, then Global Routing
A common conflict occurs when a broad condition overrides a specific one—for example, when you want to disconnect on home Wi-Fi but also have a condition that connects on every Wi-Fi network. If conditions are evaluated in order, put specific exceptions before general conditions. If the interface has separate settings for each network type, check the action for each type instead of assuming they share one rule list.
- Proxy: Use this when all traffic should follow the proxy route. It does not mean Config rules determine the route for every request.
- Direct: Use this for direct connections. VPN status and the route taken by a request are not the same thing.
- Config: Route traffic according to the active configuration. Check this setting when verifying DOMAIN-SUFFIX, GEOIP, IP-CIDR, or FINAL rules.
- Scene: Route traffic according to the configured scene. Check the scene that is actually selected; it is not interchangeable with Config.
The following is a syntax excerpt from the [Rule] section in Config. It illustrates rule order; it is not a complete configuration or an On Demand setting. The domains and IP ranges are examples. Keep your existing working configuration and don’t replace it with this excerpt.
[Rule]
DOMAIN,example.com,DIRECT
DOMAIN-SUFFIX,example.org,REJECT
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYRequests are matched against rules in order, and FINAL handles requests that don’t match an earlier rule. In the IP-CIDR example, no-resolve means the rule does not actively resolve domain names. If a page is blocked by REJECT after auto-connect succeeds, adjust the relevant rule instead of repeatedly toggling On Demand.
7. Common issues and a simple test log
Why does it reconnect after I turn it off manually?
Go to Settings → On Demand and pause On Demand before turning off the switch at the top of Home. If you only disconnect but leave the trigger conditions enabled, a network change or new evaluation may start the connection again. If it still reconnects, check other automatic connection settings.
Why does the same Wi-Fi connect sometimes but not others?
Check the actual SSID and make sure you haven’t switched to another network with a different name, such as a separate band. Also confirm that any public Wi-Fi sign-in is complete. Temporarily remove other conditions and test just this one to avoid mistaking an unavailable network for a failed condition.
The VPN is connected. Why won’t the website open?
Run Connectivity Test in Home to confirm the current server is available. Then check Global Routing and which Config rule matches. If only certain domains fail, check DNS and REJECT rules instead of rebuilding the entire VPN configuration.
Why didn’t refreshing the page trigger the domain condition?
First, check that another condition hasn’t already connected the VPN. Then make sure the domain field doesn’t include a URL path. Test with a newly initiated visit and check the system DNS cache and the app’s resolution method. One refresh alone isn’t enough to conclude that the domain condition failed.
Record these four items for every test. You can judge whether automation is working as expected only when the network condition, connection status, and request result line up. Change one variable at a time, then add the next after confirming the result.
- Current network: The actual SSID or the cellular network in use.
- Expected action: Connect, disconnect, or wait for the domain condition to be evaluated.
- Actual status: The system VPN status and the connection status shown in Home.
- Request result: Connectivity Test result, whether a new page opens, and the policy used for the request.
To restore your previous setup, disable On Demand first, then restore the conditions you recorded and the active configuration. Verify that a manual connection works before enabling automation one condition at a time. This makes it easier to distinguish server issues from rule and connection-trigger problems.