On Demand controls when a connection is established; Global Routing controls how traffic is handled once connected. This guide is for users who have configured their own servers in Shadowrocket: first test a manual connection, then set Wi-Fi, cellular, and domain conditions, and finally verify each one by switching networks. This helps distinguish automatic reconnection from routing rules and server issues.
1. On Demand vs. Rules & Routing
On Demand uses Apple’s system-managed VPN mechanism to request a connection or disconnection when conditions are met. It is not a scheduled task, nor does it switch servers automatically when a webpage fails to load. Go to Settings → On Demand to review the available options. Conditions and fields may vary depending on what your device displays.
Once connected, traffic is still governed by Home → Global Routing and the active configuration. For example, an active connection with Global Routing set to Direct does not mean requests go through the selected proxy server. Likewise, adding domain rules in Config does not register domain-based On Demand triggers with the system.
Config
RecommendedUse the rules in the current configuration to determine how traffic is handled. After On Demand establishes a connection, requests are still checked against rules in order and handled according to the matching action: DIRECT, PROXY, or REJECT.
Best for: everyday use when you have specific routing needs and have checked the active configuration.
Proxy
Handle traffic that the client can process using a proxy-oriented routing mode, rather than deciding each request with the current configuration’s standard routing rules. This changes traffic handling, not the conditions that trigger On Demand.
Best for: briefly checking whether routing rules are causing the current issue.
Direct
Use a direct-connection mode. Even if On Demand establishes a VPN connection, that does not mean requests are going through a remote server.
Best for: checking whether direct access over the local network works and establishing a troubleshooting baseline.
Scene
Choose the handling method assigned to the configured scene. Check scene settings and On Demand conditions separately; the Scene name alone does not tell you how traffic is currently routed.
Best for: users with scenes already configured and tested.
Test a manual connection before enabling automatic triggers
For testing, keep one existing server and one Global Routing mode fixed. If a manual connection still cannot reach the target, fix the server or rules first; don’t add On Demand conditions yet.
2. Before you start: preparation and setup order
This guide assumes you already have your own service provider and subscription. In Home, confirm that the intended server has been imported and that its address, port, and authentication details match the information from your service provider. If you haven’t tested it after importing, first verify a manual connection and access to a destination. A successful subscription update only means the configuration was retrieved; it doesn’t guarantee that every server can connect.
-
Test the connection
Go to Home, select a known working server, and turn on the connection manually. If the system prompts you to authorize a VPN configuration for the first time, verify the app name and follow the system prompts to grant access.
-
Choose a routing mode
Go to Home → Global Routing and choose the mode you plan to use. If you’re using Config, first check the selected configuration file and its rules in Config.
-
Open On Demand
Go to Settings → On Demand. Note the existing settings, then enable On Demand. Start with just one network condition; don’t change Wi-Fi, cellular, and domain conditions all at once.
-
Save and switch networks
Save your changes or return to the previous screen as prompted, then switch to the target network. Check the connection status in Home and access a known working test destination.
-
Check disconnection
Leave the network you just tested and see whether the connection behaves as expected. Then return to Settings → On Demand and add the next condition. After each change, test both joining and leaving the network.
Refer to the App Store page for system requirements and device compatibility. If a device management policy applies or the system won’t allow a VPN configuration, resolve the authorization issue first. Don’t mistake the system’s refusal to establish a VPN connection for an On Demand condition not matching.
3. Set Wi-Fi and cellular conditions
A Wi-Fi condition checks the network your device is currently connected to, not nearby networks it can detect. If Settings → On Demand offers a condition for a specific Wi-Fi name, enter the SSID exactly as it appears on your device, including capitalization, spaces, and any trailing characters. For example, Home-WiFi and Home-WiFi-5G are different names. Don’t substitute the router brand or a nickname you gave the network for its SSID.
A common goal is “disconnect on a specific home Wi-Fi network, connect on cellular.” Set up a disconnection action for that Wi-Fi network and a connection action for cellular separately. Adding a condition for your home Wi-Fi alone does not define behavior on every other network. The table below is a test plan example, not a default app setting or a report of measured results.
| Network condition | Expected action | How to test |
|---|---|---|
| Connected to Home-WiFi | Disconnect | Switch from cellular to this Wi-Fi network, then check the status in Home |
| Cellular network | Connect | Turn off Wi-Fi, confirm cellular data works, then make a request |
| Other Wi-Fi network | Handle according to its own settings | Connect to another Wi-Fi network you’re authorized to use and check that no cases were overlooked |
| No network available | Remote connection cannot be established | Restore network access first, then check whether the condition works |
- Networks with the same name: An SSID does not prove that a network is trusted. Different locations can use the same name, so don’t assume a network is safe for direct connections based on its name alone.
- Captive portals: For Wi-Fi that requires browser-based sign-in, complete the network login first. If On Demand interferes with authentication, temporarily turn it off, sign in, then re-enable it and test again.
- Network transitions: There may be a brief gap between Wi-Fi disconnecting and cellular data becoming available. Test after the new network is accessible rather than relying on the icon shown during the transition.
If the interface offers condition ordering or a general fallback condition, make sure a broad condition doesn’t override exceptions for specific SSIDs. The most reliable approach is to add one condition at a time and record the result on each network, rather than configuring several conditions at once and testing only the current Wi-Fi network.
4. Domain triggers are not DOMAIN-SUFFIX routing rules
Domain-based On Demand conditions involve the system evaluating domain resolution and connection needs; they do not monitor every visit in a browser’s address bar. Check Settings → On Demand to see whether your current interface offers domain-related conditions and how they work. If there’s no such option, don’t use Config rules as a substitute.
Enter a hostname in the domain field, such as portal.example.com, not a URL with a protocol, port, and path like https://portal.example.com:443/account. Whether a parent domain includes subdomains or supports wildcards depends on how the field is defined; don’t assume it uses DOMAIN-SUFFIX syntax. The system’s domain-based On Demand mechanism may also use resolution results to decide whether a connection is needed, so it can’t guarantee a new connection on every visit.
The examples below explain Config rules only; they are not an importable On Demand configuration. example.com is an illustrative domain. In practice, verify a business domain you’re authorized to access and back up your configuration first.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTDOMAIN-SUFFIX,example.com,PROXY: In rule mode, sends traffic matching this domain suffix to the PROXY policy.FINAL,DIRECT: Uses DIRECT when none of the preceding rules match. This is not an instruction to retry with a direct connection after a connection fails.- Before testing domain triggers, check the DNS settings and resolution path for the domain in your current configuration. Browser and DNS caches, as well as reused app connections, can mean a page refresh doesn’t trigger a new domain evaluation.
To test, close the page and open it again, then check the DNS resolution and connection records. Using an IP address is not a substitute for testing a domain condition, as it may bypass the domain lookup. Don’t delete all DNS settings to “force a trigger” either; that changes several variables at once.
5. Manual controls, automatic reconnection, and troubleshooting
With On Demand enabled, manually turning off the connection may not disable automatic connections permanently. The system may start another connection when a new network event occurs or a matching request is made. To pause automation, first turn off On Demand in Settings → On Demand, then turn off the connection in Home and make a request to confirm its status.
Likewise, turning on a connection manually doesn’t prove that an On Demand condition is correct. A useful test records the current network, the connection’s previous status, the action that triggered the test, and the connection’s status afterward. A screenshot showing only that the connection is on can’t distinguish a manual action from a system trigger.
- Check the underlying network first: Turn off On Demand and check whether Wi-Fi or cellular works on its own. If the network requires sign-in, has no signal, or cellular data is disabled, restore basic network access first.
- Then check VPN authorization: Confirm that the system VPN configuration is still valid, isn’t restricted by a management policy, and isn’t competing with another VPN configuration.
- Then check the trigger conditions: Verify the SSID, network type, and action. Keep only one test condition at a time and see whether the issue still occurs.
- Finally, check traffic handling: If the connection is established but the destination is inaccessible, check Global Routing, the active Config, DNS, and server availability. Don’t keep changing the trigger conditions.
Troubleshoot by connection status
If no connection is ever established, start with system authorization and On Demand conditions. If the connection is established but requests fail, check the network, server, and routing rules. Don’t update a subscription, switch servers, and rewrite rules in the same test.
6. Common questions about On Demand
Why does it reconnect after I turn it off in Home?
First check whether On Demand is still enabled in Settings → On Demand. To stop automatic connections, turn off On Demand before turning off the Home switch. Then switch networks or make a request to confirm that it doesn’t reconnect under the previous conditions.
Why does Wi-Fi trigger a connection but cellular doesn’t?
Turn off Wi-Fi and confirm that cellular data works. Then check that a cellular network condition and connection action are actually configured. Keep the same server selected and test a manual connection first to distinguish cellular access restrictions from a trigger-condition issue.
Why doesn’t adding DOMAIN-SUFFIX turn on the connection automatically?
That rule is in Config and only matches traffic. Check the system’s On Demand conditions in Settings → On Demand. If you want to route traffic by domain only while a connection is already active, use Global Routing → Config; there’s no need to turn a routing requirement into a connection trigger.
Will updating my subscription also fix On Demand settings?
Subscription updates and On Demand are separate settings. Updating the server list won’t necessarily fix system trigger conditions. After an update, check the selected server in Home, then review the conditions separately in Settings → On Demand.
Do I need to test again on iPad?
Yes. Check VPN authorization, Settings → On Demand, and the Wi-Fi network actually connected to the iPad. Cellular testing applies only to devices with the relevant capability and an active data service. Refer to the App Store page for system requirements.