Shadowrocket On Demand Setup: Automate Connections by Wi-Fi, Cellular, and Domain

On Demand vs. Rules & Routing

On Demand settings are the entry point for the system’s on-demand connection feature, under Settings → On Demand. They define when a VPN connection is needed—not which route a particular website must use. The available toggles, conditions, and default behavior depend on what the app currently shows. When setting this up for the first time, enable just one network condition and verify it before adding exceptions.

Rules & Routing take effect after the tunnel is established and are controlled by Global Routing on Home and the selected Config. With Config selected, requests are handled according to that configuration. Proxy, Direct, and Scene are other routing modes, not On Demand triggers. An automatic connection does not mean every request goes through a proxy, and selecting Direct does not disconnect the system VPN.

Network changes, domain lookups, or subsequent network activity may prompt the system to reevaluate conditions, depending on the saved rules and system state. On Demand is not a connection checker that runs at fixed intervals. Tunnel establishment, reachability of the remote service, and access to the target website are three separate things to verify.

Before You Start: Establish a Manual Connection Baseline

A manual connection baseline is a result you can reproduce with automatic triggers disabled. Keep your existing protocol settings unchanged and connect once from Home using a service you have already configured. This guide assumes you already have your own service provider and subscription; it does not cover where to get a service.

1. Go to Settings → On Demand, note the current settings, and temporarily turn off On Demand to prevent the system from initiating another connection during troubleshooting.
2. Return to Home and select the service you plan to use. If you imported it with Subscribe, confirm that the update succeeded and check which item is actually selected. An updated list does not mean a usable item was selected automatically.
3. Check Home → Global Routing. To route traffic according to a configuration, select Config, then open Config and confirm which file is in use.
4. Turn on the connection switch on Home. If the system asks you to authorize a VPN configuration for the first time, follow the system prompts. Authorization alone does not confirm that the remote service is reachable.
5. Visit one page that should be directly accessible and one destination that requires your existing proxy policy. Note the connection status, any error messages, and the current network type.
6. Disconnect and connect again. If the manual connection itself is unreliable, check the address, port, authentication, and DNS before configuring automatic triggers.

Wi-Fi: Set Conditions by SSID

An SSID is the name of a Wi-Fi network—not the router’s admin address or the access point’s hardware address. When setting conditions by SSID, check the full name in your device’s Wi-Fi information, preserving spaces, capitalization, and symbols. Don’t assume that matching ignores these differences.

The right Wi-Fi condition depends on what you want to do. For example, if you don’t want a tunnel to connect automatically on your home network but do want it to connect on demand after you leave, you can add your home SSID as an exception. If you want a connection on every network, you may not need an exception. “Home” describes how you use a network; it is not a security level recognized by the system.

1. In your device’s Wi-Fi settings, note the network name, such as Home-5G. This is only an example; enter your own SSID.
2. Go to Settings → On Demand and look for the Wi-Fi and SSID conditions available in the current interface. Read the list description first to confirm whether it includes matches or excludes them.
3. Choose the action that matches your goal. If you don’t want a particular SSID to connect automatically, use the exclusion or disconnect behavior supported by the interface. If the only option is to ignore the condition, don’t treat “ignore” as “disconnect now.”
4. Save your settings and enable On Demand. Make a new request on that SSID, then switch to another known network and repeat the test.
5. If the app can’t access the current SSID, check whether the system requests a relevant permission and review the current system access restrictions. A name the app cannot identify is not evidence that the condition matched successfully.

Public Wi-Fi may require sign-in through a web page before you can access the internet. If connection behavior interferes with the captive portal, temporarily turn off On Demand and disconnect the VPN, complete network sign-in, then restore your original settings. The same SSID can appear in different places, so its name alone cannot establish a network’s identity or guarantee its security.

Cellular: Test Connections After Switching Networks

Cellular conditions govern on-demand behavior when the device uses mobile data and should be recorded separately from Wi-Fi conditions. Use the behavior shown in the current app as your guide. If you want connections to continue on demand after leaving Wi-Fi, first confirm that cellular data works, then enable the relevant condition. Don’t treat a successful Wi-Fi test as a cellular test.

1. Go to Settings → On Demand, review the cellular conditions shown in the current interface, and save the behavior you want.
2. Turn off Wi-Fi and confirm that the device is using cellular data and that the system allows Shadowrocket to use mobile data.
3. Make a new request and note how the VPN status changes after the network switch. Don’t judge service quality by the load time of a single page.
4. Reconnect to Wi-Fi and check whether the SSID condition behaves as expected. Then switch back to cellular and test again.
5. If only cellular fails, keep the On Demand settings unchanged and test the same service manually. This helps distinguish a trigger issue from a remote connection issue.

Switching networks changes the local address, routing, and reachability. Existing TCP connections may drop, and apps may need to reconnect. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different transports and parameters. On Demand does not fix incorrect addresses, ports, or authentication for these protocols, and cannot guarantee that existing sessions will survive a network switch.

Domain Conditions: Separate Connection Triggers from Routing Rules

Domain triggers are connection-evaluation conditions in the system’s on-demand rules; they are not the same as domain-based routing in Config. Apple’s domain-based on-demand mechanism can use domain resolution conditions to decide whether to try establishing a connection. It does not necessarily start a tunnel whenever any web address is accessed. Check the current Shadowrocket interface to see whether the relevant editing options are available and which matches and actions they support. Don’t guess at configuration keys for options that aren’t shown.

Enter a hostname in the domain field, not a full URL. For example, if the target page is https://portal.example.com/account, the hostname for the domain condition is portal.example.com. Don’t include https://, the path /account, or the port :443. Check the field’s instructions to confirm wildcard behavior and which subdomains are covered.

• Exact hostname: portal.example.com specifies this host. Don’t assume it includes other subdomains based on the name alone.
• Domain scope: Whether example.com also covers api.example.com depends on how the condition matches. If that isn’t specified, add and test them separately.
• Cache effects: Existing DNS cache entries or reused connections may mean that a new visit doesn’t trigger the expected lookup. Check a new request and connection records instead of repeatedly refreshing the same page.
• App behavior: Don’t assume an app will trigger a system domain-based on-demand condition if it resolves domains itself, uses encrypted DNS, or connects directly to an IP address.

Rules in Config determine how traffic exits the tunnel. The following is a syntax example for the configuration rules section, not an entry for Settings → On Demand. PROXY must resolve to a valid policy in the current configuration. This rule does not register a system-level domain trigger.

DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX matches domain suffixes, while FINAL sets the policy for requests that did not match any preceding rules. In this example, all other requests go to DIRECT. If you only want a particular domain to use a proxy, you would usually route it with Config and keep the tunnel connected as needed, rather than adding a domain trigger for that purpose. Back up your existing rules before editing so you don’t overwrite the full configuration with an example.

Manual Toggle: Disconnecting Doesn’t Disable Automatic Triggers

The connection switch on Home controls the current connection; On Demand controls what the system does later when conditions are met. If On Demand is enabled, manually disconnecting may only change the current state. A later network change or qualifying request can still trigger a connection. The timing depends on the system and saved conditions, so a new connection does not automatically mean the toggle is broken.

Verify and Roll Back: Find the Failure Point in Order

A test log helps distinguish “didn’t trigger” from “connected but unusable.” Work through the table one item at a time, changing the next only after completing the previous test. Don’t update Subscribe, switch protocols, change DNS, and alter SSID conditions all at once, or you’ll lose a comparable baseline.

To roll back to a minimal working setup, turn off Settings → On Demand, keep your existing service and Config, and connect manually from Home. Once that works, add one Wi-Fi condition and test it, then test the cellular condition, and finally configure domain conditions only if needed. When sharing troubleshooting notes, hide subscription credentials, service passwords, and personal network names. Include only the relevant status and error details.