On Demand determines when to establish or disconnect the system VPN connection. Rules in Config determine how traffic is routed after the connection is established. For iPhone and iPad users with working connection details, this guide covers Settings → On Demand, SSID conditions, cellular networks, domain evaluation, and a reliable testing sequence. Verify a manual connection first, then add automatic triggers to distinguish connection problems from misconfigured conditions.
How On Demand and Config Differ
Shadowrocket uses the system’s On Demand connection mechanism. It does not periodically tap the connection switch on Home or select a different node for every request. When the network changes or a matching request occurs, the system evaluates the saved On Demand rules and decides what connection action to take. Once the tunnel is established, traffic is still handled by the current Global Routing setting and Config rules.
So “connected automatically” and “the request uses a proxy” are two different outcomes. If Global Routing is set to Config, check the selected configuration and matching rules in Config. If it is set to Direct, seeing that the VPN is connected does not mean the request went through a proxy. Proxy is a global proxy mode, so its test results should not be used as a substitute for checking routing under Config.
- Home: Select a working node you already have, connect manually, and test the target request.
- Settings → On Demand: Set automatic connection conditions and check the master switch, actions, and condition scope.
- Config: Check routing after the connection is established, including DOMAIN-SUFFIX, IP-CIDR, and FINAL rules.
Before You Start: Keep a Connection You Can Test Manually
Before configuring On Demand, make sure a manual connection works on the same network. This guide assumes you already have a service provider and subscription. A successful subscription update only confirms that configuration data was retrieved; it does not prove that every node can connect. Check that node addresses, ports, and protocol settings match your existing configuration. Do not use automatic reconnection to mask incorrect settings.
- On Home, select a node you have confirmed works, temporarily turn off On Demand, and note the current Global Routing setting.
- Turn on the connection manually, visit a target known to require the current configuration, and then check the actual policy in the connection log.
- Disconnect and go to Settings → On Demand. Add just one network rule with a clearly defined scope, save it, and then enable On Demand.
- If the system asks to add or update a VPN configuration, approve it when prompted. Then check the Connect On Demand status in the details for the relevant VPN configuration in system settings.
The system settings layout may vary. Search for VPN in system settings, then open the details for the Shadowrocket configuration. Do not check only the in-app switch: the VPN configuration saved by the system also affects On Demand behavior. Refer to the App Store page for system requirements and device compatibility. An iPad with Wi-Fi only cannot be used to test switching to cellular.
Wi-Fi SSIDs: Put Exceptions Before Broad Conditions
An SSID is a Wi-Fi network name, not a router admin address or node name. To disconnect on one specific Wi-Fi network and connect automatically on other Wi-Fi networks, first add a Disconnect condition for that SSID, then add a broader Wi-Fi Connect condition. The system evaluates On Demand rules in order. If a broad condition comes first, a later rule for a specific SSID may never take effect.
Specific Wi-Fi Exception
- Settings path
- Settings → On Demand
- Interface condition
- Wi-Fi
- Example SSID
- HomeNet-5G
- Action
- Disconnect
- Order
- Place before the broad Wi-Fi condition
HomeNet-5G is an example network name. Replace it with the SSID your device actually connects to.
Other network conditions
- Settings path
- Settings → On Demand
- Subsequent condition
- Other Wi-Fi
- Action
- Connect
- Separate condition
- Cellular
- How to test
- Switch networks, then make a new request
This is a plan for setting up conditions, not configuration syntax you can paste. Save the conditions using the options available in the app.
When entering a network name, preserve its capitalization, spaces, and symbols. Do not assume that the name field supports wildcards. For example, HomeNet and HomeNet-5G are different names. Two access points with the same SSID may also match the same condition. An SSID condition matches a network name; it does not independently establish that the network is trusted. Decide whether to disconnect on a particular Wi-Fi network based on your actual needs there.
In Short: Verify One SSID Condition First
Start with only the rule for the specified SSID. Test both joining and leaving that network. Once the results match expectations, add conditions for other Wi-Fi networks and Cellular. This makes it easier to tell whether the SSID is mismatched or a later rule is overriding the expected behavior.
Cellular: Test Network Switching and Reconnection Separately
A Cellular condition applies to the cellular interface; it is not the same as “not connected to the specified Wi-Fi.” If you have only a Disconnect condition for one SSID and no condition covering cellular, you cannot infer what will happen after leaving that Wi-Fi network from the exception alone. To connect automatically, add the appropriate Cellular Connect condition and make sure no broader Disconnect condition takes precedence.
- On the target Wi-Fi network, confirm that the Disconnect condition takes effect and note the system VPN status.
- Turn off Wi-Fi in system settings. Confirm that the device is using cellular, rather than simply being disconnected from the current access point.
- Open a new webpage or make a new request in an app. Check whether the system VPN connects, then review the connection and request logs in Shadowrocket.
- Turn Wi-Fi back on and reconnect to the specified SSID. Confirm that the new network evaluation matches the Disconnect condition.
An existing connection may drop during a network switch, and a page may continue showing cached content. To check whether automatic connection worked, look at a new request and the system VPN status—not just whether the page refreshed immediately. If the VPN is connected but access fails, check whether the node is reachable over cellular, whether DNS is working, and which rule in the current Config applies to the target. Do not add duplicate Connect conditions.
Domain Triggers: Separate Connection Evaluation from DOMAIN-SUFFIX
Domain-based triggering depends on system connection evaluation; adding a domain to Config alone will not bring up the tunnel. The system’s On Demand Evaluate Connection mechanism can use domains and resolution conditions to decide whether to attempt a connection. Connect If Needed does not mean “connect unconditionally on every visit.” Use the domain evaluation options actually available in the current On Demand editor. Do not paste DOMAIN-SUFFIX rules from Config into network conditions.
| Item | Stage | What to check |
|---|---|---|
| On Demand domain evaluation | Determines whether a connection needs to be established | Domain conditions, resolution results, and the corresponding connection action |
| DOMAIN-SUFFIX | Traffic matching after the connection is established | Domain suffix and policy name |
| IP-CIDR | Address matching after the connection is established | Whether the destination IP falls within the specified subnet |
| FINAL | When no earlier rule matches | Whether the fallback policy matches expectations |
For example, DOMAIN-SUFFIX,example.com,PROXY in Config is a domain-suffix routing condition, not an instruction to start On Demand automatically. Here, example.com is used only to illustrate the rule structure, and PROXY must also be valid in the current configuration. For a domain-trigger test, enter the domain—not a full webpage address with a path and query parameters.
- Check for an earlier match: If an earlier network condition is already set to Connect, the tunnel may already be up. You cannot then confirm that the later domain evaluation triggered it.
- Check the resolution path: DNS caching or an app’s use of encrypted DNS may mean the test does not go through the expected system resolution evaluation.
- Check the connection lifecycle: Closing a webpage does not immediately disconnect the VPN. Domain evaluation is not simply a switch tied to a browser tab.
If the current editor does not offer the domain evaluation options you need, use Wi-Fi or Cellular conditions that you can verify instead. Do not use a Config rule with a similar name as a substitute. When testing, change only one domain or network condition at a time and keep a record of the original configuration. This avoids attributing a result to one rule when two mechanisms changed at once.
Rule Priority and Common Misconfigurations: Check One Symptom at a Time
On Demand order and Config rule order are separate layers. On Demand controls connection actions; Config controls traffic policy. Moving FINAL to the end will not fix an SSID condition, and changing SSID rule order will not fix a destination domain using the wrong policy. Troubleshoot in two steps: first confirm whether the system established the tunnel, then check which rule matched the request.
Why does the connection come back after I turn it off on Home?
Go to Settings → On Demand and check whether automatic connection is still enabled. To pause automatic behavior, turn off On Demand, check Connect On Demand in the system VPN configuration, and then disconnect manually. Using the switch on Home alone does not disable On Demand conditions.
Why does it still connect when I set Disconnect for a specific Wi-Fi network?
First check the actual SSID in the system’s Wi-Fi details, then review the rule order. Move the specific SSID condition before the broad Wi-Fi Connect condition. Save, reconnect to that network, make a new request, and check the status.
Cellular connects automatically, but webpages won’t load. What should I check?
Temporarily turn off On Demand and test a manual connection on the same cellular network. If that fails too, go to Home and check the selected node, then verify the protocol settings, DNS, and Global Routing. Fix basic connectivity before restoring automatic conditions.
Why doesn’t a domain rule in Config connect automatically when I visit the domain?
DOMAIN-SUFFIX only handles traffic routing. Go to Settings → On Demand and check for a connection condition that applies. For domain evaluation, also check preceding network rules, the system resolution path, and caching. A Config match cannot replace system connection evaluation.
After configuring On Demand, keep at least one repeatable test record: the current network, SSID or Cellular, the matching On Demand condition, system VPN status, and the actual policy for a new request. Record only what is necessary; do not share subscription URLs, authentication details, or complete connection settings. Change one thing at a time and repeat the same test path. This makes issues easier to isolate than adding several exceptions at once.
- Specified Wi-Fi: Check Disconnect after joining, then check the next applicable condition after leaving.
- Other Wi-Fi: Confirm that a Connect condition covers the current network. Complete web authentication first if required.
- Cellular: Confirm that the interface has switched, then use a new request to test the connection and routing.
- Domain evaluation: Isolate the effect of broad Connect conditions, then check resolution and trigger results.