On Demand controls when the system VPN connects or disconnects; it does not determine the outbound policy for each request. This guide is for users who can already connect manually and want to automate connections based on Wi-Fi, cellular, or domain conditions. Configure and test each option under Settings → On Demand, then check Home → Global Routing and the rules in Config.
Understand On Demand, Connection Status, and Routing Separately
Shadowrocket’s On Demand feature uses Apple’s system VPN mechanism. When the network changes or a request meets a domain evaluation condition, the system can use your saved settings to decide whether to connect. Turning on On Demand does not mean the tunnel is connected right now, nor that every request will use a proxy route.
Check each layer separately: On Demand determines when to connect; the Home connection toggle and system VPN status show whether you are currently connected; Home → Global Routing determines how traffic is handled. When Config is selected, rules in the active configuration determine the policy for each request. Do not treat the VPN indicator alone as proof of how a request was routed.
Proxy and Direct set the overall handling mode, Config uses the active configuration, and Scene applies the selected scene. These are separate from On Demand. For example, the system may establish a tunnel on demand while Global Routing is set to Direct. In that case, an automatic connection does not mean the target request used a proxy route.
Get a Manual Connection Working First
This guide assumes you already have your own provider, connection details, or subscription. On Demand does not supply server addresses, authentication details, or subscription content. First confirm that the same configuration works when connected manually. Then add automatic triggers so you can distinguish connection problems from condition-matching issues.
- On Home, check the existing connection entry and confirm that its address, port, and protocol settings match your service details. Enter the port exactly as provided; do not change it to
443just because you enabled On Demand. - Turn on the connection manually. If the system asks to add a VPN configuration, review the prompt and authorize it. This authorization is separate from routing rules in your configuration.
- Visit a service you are authorized to use and confirm that the active configuration works. If you need rule-based routing, check that Home → Global Routing is set to Config and verify which file is selected in Config.
- Go to Settings → On Demand and note the existing conditions before changing them. After saving, search for “VPN” in the system Settings, open the VPN configuration for Shadowrocket, and check that On Demand is enabled.
Keep a record of the original settings while troubleshooting; there is no need to repeatedly delete the VPN configuration. Deleting it may also remove system authorization and On Demand status, prompting you to authorize the next connection again and making results harder to compare.
Set Connection Conditions for Wi-Fi Names and Cellular
Start by defining the expected behavior for each network: which Wi-Fi name should disconnect, whether to connect on other Wi-Fi networks, and whether to connect on cellular. A Wi-Fi name is its SSID—not the router’s admin address or your device’s local IP address. Check the exact name, including capitalization, spaces, and suffixes.
Example: Condition for a Specific Wi-Fi Network
- Setting
- Settings → On Demand
- Network type
- Wi-Fi
- Example SSID
Home-WiFi- Action
- Disconnect
Use this only if you want the tunnel to disconnect on this network. Home-WiFi is an example name; replace it with the SSID your device actually connects to.
Example: Cellular Condition
- Setting
- Settings → On Demand
- Network type
- Cellular
- Action
- Connect
- How to test
- Turn off Wi-Fi and make a new request
Check cellular and specific SSID conditions separately. You do not need to enter a Wi-Fi name for cellular.
In the available conditions and actions, Connect establishes a connection when a condition is met; Disconnect ends it. “Disconnect on a specific Wi-Fi network” does not mean “disconnect on all Wi-Fi networks.” If a broad Wi-Fi condition overlaps with a specific SSID condition, check their priority so the broader condition does not override the specific one.
- Matching and different names: If the two bands on the same router use different SSIDs, check each one separately. Entering only one name does not confirm that the other will match.
- Permissions and names: If the conditions screen cannot retrieve the current Wi-Fi name, check the relevant permissions as prompted by the system. Do not test a match using an empty value.
- Captive portals: For Wi-Fi networks that require web authentication, complete sign-in first, then test the tunnel and target service. An incomplete sign-in does not indicate that your server settings are wrong.
- Overlapping conditions: Start with one condition for a specific network and one clearly defined behavior for other networks. Once both work, add other SSIDs.
Domain Triggers Are Not DOMAIN-SUFFIX Routing
Network conditions are about which network your device is connected to; domain conditions are about domain-related requests the system is handling. On-demand domain evaluation is performed by the system and depends on DNS resolution and the configured evaluation conditions. It does not mean that typing text into a browser will always trigger a connection. Whether an app starts a new lookup or reuses a cache or existing connection can also affect the result.
When setting domain conditions under Settings → On Demand, enter a hostname, not a complete web address. For example, use portal.example.com as a test domain; do not enter https://portal.example.com:443/account. The latter includes a scheme, port, and path, so it is not suitable for a domain field. This example is for formatting only, not a service address.
| Where to configure | What it controls | What to enter |
|---|---|---|
| Settings → On Demand | Whether to establish a system VPN connection when a domain evaluation condition is met | Enter a hostname in the domain field and check the corresponding evaluation action |
| Rules in Config | Which policy to use for a request after the connection is established | DOMAIN-SUFFIX,example.com,PROXY |
| Fallback rule in Config | Which policy to use when none of the preceding rules match | FINAL,DIRECT |
System domain evaluation may include logic such as connecting when needed, for example in relation to a failed lookup or a specified resolution condition. It does not mean that every matching domain immediately triggers a connection. Use the options shown on the current conditions screen. If the interface does not provide a DNS evaluation field, do not paste a field from another configuration format into the domain list.
Bottom line: Test Domain Conditions with a New Request
Keep one domain condition you can control, end any existing session, and make a new request while watching the system VPN status. After confirming that the connection was triggered, check which routing policy the request matched. Do not change both layers at once.
Three Common Setups and How to Test Them
For each setup, define the expected behavior on each network before adding domain exceptions. These are configuration approaches, not claims that a particular network is inherently safe or must be disconnected. Whether to connect depends on your needs and whether your service supports that network environment.
| Goal | Condition approach | Test steps |
|---|---|---|
| Stay disconnected on a specific Wi-Fi network; connect when away | Set the specific SSID to Disconnect; use Connect on other Wi-Fi networks and cellular as needed | Connect to the specified SSID first, switch to another Wi-Fi network, then turn off Wi-Fi to test cellular |
| Connect automatically on cellular only | Set cellular to Connect; explicitly configure Wi-Fi not to establish a connection automatically | Make a new request on both Wi-Fi and cellular, then check the system VPN status |
| Evaluate a connection only when a specific domain is needed | Use a domain evaluation condition and make sure no broad Connect condition establishes the connection first | First confirm that the tunnel is disconnected, then visit your test domain and check resolution and connection status |
- Change one condition per test. Record the current network, actual SSID, action, and system VPN status.
- After switching networks, wait for the system to finish connecting, then make a new request. Do not use an existing connection that is still playing to judge the new condition.
- Check first whether the tunnel connects, then whether the target request succeeds. Record the two results separately.
- If the result is unexpected, restore the last working conditions first, then check for overlapping conditions or an On Demand setting that is disabled in the system configuration.
Changing several conditions repeatedly can make it hard to separate network switches, cached DNS results, routing mode, and service availability. A consistent test sequence helps, but one successful test does not prove that every app’s background requests will trigger at the same time.
Troubleshoot Repeated Toggle Changes or Missing Triggers
Why does it reconnect after I turn it off manually?
First check Settings → On Demand for a Connect condition that matches the current network. Then search for “VPN” in system Settings and check On Demand for the corresponding configuration. To pause automatic connections, disable On Demand before turning off the Home connection toggle. Turning off only the current connection may not prevent a later request from triggering another connection.
Why doesn’t it connect automatically when I switch to cellular?
First confirm that the device is actually using cellular data and is no longer connected to Wi-Fi. Then check the cellular action and system On Demand status before making a new request. If it still does not connect, temporarily turn off On Demand and connect the same entry manually to distinguish a condition mismatch from a service issue.
Why is it still connected when Disconnect is set for a specific Wi-Fi network?
Check the full current SSID. Make sure you are not connected to a similarly named network on another band or to a guest network, then look for broader connection conditions. After saving, reconnect to that Wi-Fi network and check the system VPN status. Do not rely only on the toggle in the condition editor.
The domain didn’t trigger a connection. Are my rules wrong?
First check that the domain field under Settings → On Demand contains a hostname, not a full URL. Then confirm that the test request caused a new domain lookup and check the domain evaluation action. DOMAIN-SUFFIX in Config only handles routing; it cannot replace a system On Demand condition.
Why is the connection automatic, but the result still wrong?
Go to Home → Global Routing and check the current mode. If you use Config, review the order of DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL in the active configuration. After a connection is triggered, a request may still match DIRECT or another policy. Check routing instead of adding more On Demand conditions.
If you deleted the system VPN configuration, connect manually from Shadowrocket and complete any required system authorization first, then check that On Demand has been saved again. If the system VPN configuration you are testing is not the one for Shadowrocket, select the correct configuration before treating its status as the test result.