Shadowrocket On Demand Rules: Automatically Connect by Wi-Fi, Cellular, and Domain

1. On Demand vs. post-connection routing rules

Before configuring anything, keep this distinction in mind: to connect automatically based on network conditions, check Settings → On Demand. If the VPN is connected but a website is routed incorrectly, check Home → Global Routing and the active configuration in Config. These work at different stages. Adding domain routing rules to a configuration does not create a system-level On Demand trigger.

On Demand relies on Apple’s system VPN on-demand mechanism. The system evaluates whether to connect based on the current network and saved conditions. Once connected, Shadowrocket handles traffic according to the selected routing mode. Events such as network changes and name-resolution requests may factor into this evaluation, but On Demand does not continuously scan foreground webpages or start and stop based on whether an app is open.

• Proxy: Uses proxy routing; this does not mean traffic is routed by evaluating each configuration rule.
• Direct: Uses direct routing. A connected VPN status does not mean every request is sent through a proxy.
• Config: Routes requests according to the rules in the active configuration. Use this to verify domain-based routing.
• Scene: Selects routing for a particular scene. Check the active scene’s settings too; a scene is not an On Demand connection action.

For example, DOMAIN-SUFFIX,example.com,DIRECT in a configuration sends matching domain suffixes direct, while FINAL,DIRECT sets the fallback when no earlier rule matches. These rules do not start the system VPN. GEOIP (matching by IP geolocation) and IP-CIDR (matching by IP range) also operate at the traffic-handling stage; neither replaces Wi-Fi or cellular conditions.

2. Check access, connection, and recovery before you begin

First confirm that a manual connection works, then enable automation. These steps focus on iPhone and iPad. For system requirements, refer to the App Store listing. Available fields may vary by system and app interface; use the options currently shown in Settings → On Demand. Do not assume a system action will appear as a button in every interface.

1. In Home, select an available connection you already have and turn it on manually. If the system prompts you to add a VPN configuration for the first time, verify the app and follow the system prompts to approve it.
2. Open a page that normally works and confirm the network itself is available. If a manual connection fails, troubleshoot the connection details, network reachability, or configuration first.
3. Note the current Global Routing mode and the active configuration in Config, so you can restore them if you change either while testing.
4. Go to Settings → On Demand and note the existing conditions and their order. Change only the item you need to test; do not update a subscription or switch connections at the same time.
5. Remember where to find the corresponding VPN configuration in Settings → General → VPN & Device Management → VPN. If the system shows an option related to On Demand, check its status too.

3. Connect or disconnect based on Wi-Fi name

A Wi-Fi name condition usually refers to the SSID (the wireless network name). It matches the network name—not the router brand or a website domain. This example uses the fictional name Home-WiFi to illustrate the goal of disconnecting on a specific Wi-Fi network and connecting on cellular. Whether to disconnect on a particular network depends on your needs; a network name like “home” does not automatically make it trustworthy.

1. In your system Wi-Fi settings, check the full name of the connected network. Preserve its spaces, symbols, and capitalization; do not substitute a note such as “home network” for the actual SSID.
2. Go to Settings → On Demand, edit the Wi-Fi condition, and enter the actual SSID to match. Home-WiFi is only an example.
3. To disconnect this VPN on the matching network, set the action to Disconnect. To connect on that network, use Connect. Save using the options shown in the current interface.
4. Check for broad conditions that apply to all Wi-Fi networks. A specific SSID exception should come before any general condition that might override it.
5. Disconnect from the Wi-Fi network and join it again to check the VPN status. Do not save the setting and immediately judge it based on a single page load on the same network.

Disconnect disconnects this VPN; it does not turn off the device’s Wi-Fi or block all network traffic. If you only want a particular domain to go direct at home, keep the VPN connected and set up routing in Config instead of disconnecting on the entire home Wi-Fi network. These approaches have different effects.

4. Automatic connection on cellular and rule order

On a device that supports cellular data, you can set the Cellular condition to Connect. After you leave a specified Wi-Fi network, the system switches to cellular data and evaluates the relevant conditions. The transition still depends on network availability, VPN setup, and subsequent requests; do not assume On Demand will keep every existing connection uninterrupted.

The system evaluates On Demand rules in order, and the first applicable matching rule determines the action. If a broad Connect condition at the top already covers every Wi-Fi network, a later Disconnect condition for a specific SSID may never take effect. Shadowrocket may organize conditions by network type, so check both the order shown in the interface and the scope of each condition—not just whether a switch is enabled.

• Put narrow exceptions first, then consider broader default conditions, so a general rule does not override an exception prematurely.
• Do not assume the system will connect or disconnect when no condition matches. Set the desired behavior for other networks explicitly and verify it.
• Disconnecting manually does not cancel automatic connection. If a later network event matches Connect, the system may establish the connection again.
• If you need ongoing manual control, turn off On Demand and check its status in the system settings before using the connection switch.

An iPad without cellular capability cannot be used to test a cellular network transition. When connected to another device’s hotspot over Wi-Fi, your device is still using its Wi-Fi interface. Evaluate the network type seen by your device, not how the hotspot itself gets online.

5. Domain-based On Demand triggers are not DOMAIN-SUFFIX routing

The idea of “connect when visiting a domain” needs some clarification. Apple’s on-demand mechanism can use EvaluateConnection and domain or name-resolution conditions to decide whether to establish a VPN connection. This is different from matching DOMAIN-SUFFIX after connecting, and it should not be understood as monitoring the browser’s address bar.

In system domain evaluation, ConnectIfNeeded (connect when needed) is generally associated with conditions such as DNS resolution failure or an unavailable required DNS server. NeverConnect (do not start a connection for matching domains) is not a website-blocking rule. These are system mechanism names. Configure them only if the current Shadowrocket interface offers the relevant conditions; do not paste them into a configuration as if they were configuration keywords.

1. First clarify what you need: “establish a connection when an internal domain is accessed while the tunnel is disconnected,” or “route a particular website a certain way while the tunnel is connected.” The latter is handled in Config.
2. In Settings → On Demand, check whether domain-related conditions and actions are available. If the current interface only offers network-type conditions, configure only what it supports; do not make up fields.
3. If the interface supports domain conditions, test with a domain you are authorized to access and that genuinely requires the relevant network environment for resolution. internal.example.com is only a syntax example and cannot be used to verify real connectivity.
4. Enter a hostname or domain as required by the field, not a complete URL. In https://internal.example.com:443/path, the scheme, port, and path are not part of the domain itself.
5. Record the DNS result while disconnected before enabling the condition. If the domain already resolves on a regular network, do not expect “connect when needed” to trigger every time.

If all you need is for example.com to go direct while other requests continue to follow the existing configuration, add the relevant domain rule to the active configuration and select Global Routing → Config. Domain routing controls where traffic goes; disconnecting the entire VPN affects requests from other apps and is not a substitute.

6. Verify the settings in three scenarios

Change one variable at a time: keep the same existing connection, active configuration, and test page. The observations below are items to record during verification, not fixed timings or performance guarantees. System evaluation and tunnel setup take time; wait for the status to stabilize before drawing conclusions.

If the status shows that the VPN is connected but the page still fails, the issue is now in post-connection handling. Check Global Routing, the active Config, DNS, and destination reachability instead of repeatedly changing the Wi-Fi name condition. If no connection action occurs at all, first check that On Demand is enabled, the current interface type, and rule priority.

• If a public Wi-Fi network requires a captive portal sign-in, complete it before testing. Being connected to Wi-Fi does not mean the network can already reach the internet.
• Temporarily turn off On Demand and connect manually on the same network. If that still fails, troubleshoot the connection itself before the automatic trigger conditions.
• Do not update a subscription or switch connections during testing; changes to connection details can make the trigger results harder to interpret.
• When testing is complete, restore the routing mode and conditions you intend to use. Do not leave temporary global direct routing or broad connection conditions in your everyday setup.

7. Automatic reconnection, name matching, and battery questions

Keep the final checks in the same order: confirm network availability, check whether the system triggered the connection, then inspect routing and DNS after connecting. Recording what happens at each stage is more useful than changing On Demand, subscriptions, and configuration all at once. See more setup guides on this site for help with the basics.