Shadowrocket On Demand Setup: Automate Connections by Wi-Fi, Cellular, and Domain

At a Glance

On Demand controls when a VPN tunnel is established; it does not replace the routing rules that apply after the tunnel is up. This guide assumes you already have a service provider and subscription and can connect manually. It covers setup, testing, and disabling On Demand for three scenarios: specific Wi-Fi networks, cellular data, and domain requests. For iPhone and iPad users who want fewer manual switches while keeping clear boundaries for when the VPN connects.

Connection vs. Routing

The Home switch starts or stops a connection. Settings → On Demand controls connection behavior based on conditions. Home → Global Routing determines how traffic is handled after connecting. These settings operate at different levels: seeing a VPN status does not mean every request goes through a proxy.

On Demand uses Apple’s system-level VPN on-demand mechanism. When the network changes or a qualifying network request occurs, the system evaluates the saved conditions. It is not a timer that continually checks web page content, and it will not start a connection just because a page contains certain text. Leaving Shadowrocket’s foreground screen also does not disable an on-demand configuration managed by the system.

3 Condition Types

This guide covers Wi-Fi, cellular, and domain requests

2 Layers

On Demand manages connections; Global Routing manages traffic paths

1 Prerequisite

Make sure you can connect successfully from Home first

Create a Minimal Test Setup

For your first test, enable just one condition. Add exceptions only after it works. The condition editor and available fields may vary with the app’s language and system environment. Start at Settings → On Demand, then use the network, SSID, domain, and connection-action fields actually shown on your screen. The examples here are guidance, not an importable configuration file.

Verify the Manual Connection

Go to Home, select an existing server, turn on the connection switch, and approve the system VPN configuration request. Run Connectivity Test, then open a page you know works. Record the test result and the page’s actual behavior separately.
Check the Routing Mode

Check the current option under Home → Global Routing. For everyday rule-based routing, select Config and confirm the active configuration file in Config. This helps avoid mistaking a connection that is still in Direct mode for a failed trigger.
Set One Condition

Go to Settings → On Demand and configure just one network condition to start—for example, a connection action for the exact SSID of the current Wi-Fi network. Save the condition and enable On Demand. Don’t add multiple conditions that may override one another at the same time.
Reset the Test Environment

Disconnect from the target network, reconnect, then make a new web request. Check the system VPN status and the status in Home—not just whether the On Demand switch is enabled.
Add Exceptions One at a Time

Once the single condition passes, add any requirements for home Wi-Fi, cellular data, or domain requests. Repeat the network-switching and access tests after each addition. If a test fails, remove the most recently added condition and keep the ones you have already verified.

If the screen has no separate field for evaluating domains, don’t put a domain in the SSID field. Adding a domain rule in Rule does not complete On Demand setup either: the former matches the wrong type of value, while the latter only changes the routing of traffic that has already entered the tunnel.

Set Conditions for Wi-Fi and Cellular

Wi-Fi conditions usually use the SSID—the wireless network name. An SSID is not the router’s admin address or the device name. Check the network information shown by the system and enter the SSID exactly, including spaces, capitalization, and punctuation. For example, treat Home-WiFi and Home-WiFi-5G as separate networks; don’t assume they match just because they come from the same router.

What to Know About Each Network Condition

Specific Wi-Fi Network

Confirm the exact SSID first, then choose the appropriate connect or disconnect action.
If you want to stay disconnected on your home Wi-Fi, add it as an explicit exception and check that a broader Wi-Fi condition does not override it.
For guest Wi-Fi that requires web-based authentication, complete the sign-in first, then test On Demand.

Cellular Network

The device must have cellular data and it must be enabled. This condition does not apply to Wi-Fi-only iPad models.
Use the network interface the device is actually using. When connected to a phone’s hotspot, your device is typically still on Wi-Fi.
For testing, turn off Wi-Fi, confirm cellular data can access the web, then make a new request.

Decide whether each network should connect or disconnect before setting conditions. A network name alone does not prove that the network is trusted.

If multiple On Demand conditions are evaluated in order, place specific exceptions before broader conditions. For example, handle the home SSID’s disconnect requirement before connecting on other Wi-Fi networks. Check the ordering controls available in your interface; don’t assume a newly added condition automatically takes priority. An overly broad fallback condition is a common reason a device connects even though an exception was set for the home network.

Network changes: After switching from Wi-Fi to cellular data, the old connection may linger briefly or be re-established. Verify behavior with a new request after the switch.
System permissions: If the SSID can’t be detected, check system restrictions on access to network information and any prompts shown in the app. Don’t replace the network name with an empty string.
Automatic disconnection: Setting a connection condition does not necessarily mean the VPN will disconnect when you leave that network. Check other conditions and the default behavior as well.

Domain Triggers vs. Domain-Based Routing

Domain-based on-demand mechanisms generally rely on the system evaluating a DNS lookup, not on reading each URL in the browser’s address bar. If the interface offers this type of condition, enter a domain such as example.com, not https://example.com/path. Check the field’s description for matching scope and subdomain behavior; don’t assume it works like DOMAIN-SUFFIX in Rule.

With Apple’s on-demand mechanism, domain evaluation can request a connection when its resolution conditions are met; it does not necessarily establish a tunnel for every domain visit. If visiting a domain does not trigger a connection right away, check the evaluation action, current DNS results, and cache—not just the spelling. Existing browser connections, an app’s own encrypted DNS, or direct use of an IP address may prevent the expected system DNS lookup from occurring.

Location	What It Controls	How to Verify
Settings → On Demand	Whether to establish a VPN based on network or domain requests	Disconnect, make a new request, and check whether the VPN connects
Rule in Config	Which rule matches a request in the tunnel and which policy it uses	After connecting, check request logs and the matched policy
Home → Global Routing	Which traffic handling mode is currently in use	Check Config, Proxy, Direct, or Scene

The Rule example below sends a specific domain through a proxy and everything else direct. It is not an On Demand condition. Add it to the Rule section of the configuration file currently in use, then test in Config mode. The proxy policy must also be able to use a working server you already have.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX matches a specified domain and its subdomains; FINAL is the catch-all rule. Rules are matched from top to bottom. GEOIP and IP-CIDR apply to destination IP locations or address ranges; they do not start a VPN tunnel that is not yet established. These rules handle routing only after On Demand has connected successfully.

Check Global Routing After Connecting

Automatic connection is only the first step. Keep Global Routing in a consistent mode during testing; otherwise, the same domain may take different paths in different modes, making On Demand behavior harder to diagnose. The options below are Shadowrocket settings and do not compare service providers.

Config

Recommended

Handle traffic according to the active configuration file. The order of domain rules, IP rules, and FINAL affects where traffic goes. This is useful when you want clear routing boundaries to remain in place after an automatic connection.

Best for: Using a prepared configuration file to route everyday requests by rule

Proxy

Use a proxy path for traffic handled in this mode to isolate the effects of rule configuration. This does not replace On Demand or guarantee that all system traffic is routed through the tunnel.

Best for: Briefly checking whether the proxy path works; restore your previous mode when finished

Direct

Use a direct connection for the traffic handled in this mode. A VPN can show as connected while a request goes direct, so the status icon alone cannot tell you whether a request went through a proxy server.

Best for: Comparing direct access to tell a website issue from a proxy-path issue

Scene

Use the handling mode configured for the selected scene. Check the scene’s settings before testing; scene selection and whether the system establishes a tunnel on demand are separate settings.

Best for: Switching handling modes by scene when the scene conditions are already configured

Manual Disconnect and Troubleshooting Order

When On Demand is enabled, turning off the Home switch may not permanently disable automatic connections. A later network change or qualifying request may prompt the system to evaluate the conditions again. Timing can also depend on how the system handles a manual disconnect. To stop On Demand explicitly, turn it off in Settings → On Demand first, then disconnect from Home.

Why Did It Connect Again After I Turned It Off?

First check whether Settings → On Demand is still enabled, then look for a broad connection condition that matches the current network. To pause it temporarily, turn off On Demand before switching off the Home connection. Switch networks again and confirm that the VPN does not reconnect automatically.

No Response After Switching to Cellular?

Make sure Wi-Fi is fully disconnected and cellular data can open web pages, then check that the condition matches the current network type. Make a new request and check Home. If a manual connection also fails, troubleshoot the basic connection instead of adding more On Demand conditions.

The Domain Is Correct. Why Didn’t It Trigger?

Check whether an earlier network condition takes precedence and verify the domain evaluation action. Close existing pages before testing again; private browsing does not guarantee that the system DNS cache is cleared. If the app uses its own DNS path, cross-check with a request that causes the system to resolve the domain.

It Connected Automatically, but the Page Won’t Load

Run Connectivity Test from Home and check Global Routing and the active Config. A latency result only reflects the test target; it does not confirm that the target domain resolves, TLS connects, or page resources load correctly. Check request logs to distinguish a resolution failure from a connection failure.

Do I Need to Reconfigure On Demand After Updating a Subscription?

Subscription updates and On Demand conditions are separate settings, so a list update alone usually does not require rebuilding your conditions. Still, check that the selected server is available and its authentication is valid, then test a manual connection. Updating the server list does not replace checking your active Config and On Demand conditions.

Verify with a Network-Switching Log

Your checks should cover at least one connection to the target Wi-Fi, one disconnection from it, one cellular data request, and one manual disconnect after disabling On Demand. Change only one variable at a time and record four things: network, triggering request, connection status, and actual access result. This helps distinguish between a trigger that never occurred, a triggered connection that failed, and a successful connection with incorrect routing.

Target Wi-Fi: Rejoin the exact SSID, make a new request, and confirm the result matches its configured connect or disconnect action.
Exception network: Switch to a Wi-Fi network configured to disconnect and make sure no broader condition overrides it.
Cellular access: Turn off Wi-Fi, confirm cellular data is available, then revisit the test domain and check the connection status.
Stop automatic connections: Turn off Settings → On Demand, then switch off the Home connection. Switch networks again to confirm that automatic connections remain disabled.

On-demand connections involve establishing a tunnel and switching networks, so not every transition will be instantaneous. Enabling automatic connections alone does not guarantee lower battery use. Keep only the conditions you need, remove duplicates, and repeat the checks above after changes. This makes issues easier to isolate than continually adding fallback rules.