Shadowrocket On Demand Setup: Automate Connections by Wi-Fi SSID, Cellular, and Domain

Before you begin: Verify the app and connect manually

Shadowrocket is a paid client for Apple platforms. It is available exclusively on the App Store as a one-time purchase. To verify the genuine app, check the official icon, developer Shadow Launch Technology Limited, and app ID 932747118. Check the App Store listing for the system requirements for iPhone and iPad and compatibility with other Apple devices. Buying the client and having a connection service are separate matters.

On Demand automates connections; it does not supply missing server addresses, authentication details, or subscription content. Before you begin, select an existing connection on Home, connect manually, and visit a destination you need to access. Later tests are meaningful only if this works. If you use your own subscription, import and update it first, then confirm the selected entry is still valid.

1. Keep a copy of the current configuration in Config and note its name to avoid confusing automatic connection problems with rule changes.
2. Check Global Routing on Home. To route traffic according to your configuration, use Config and confirm the required connection is selected.
3. Connect manually, allow the VPN configuration when prompted by the system, and test one destination that should use a proxy and one that should connect directly.
4. Note the exact SSID of the current Wi-Fi network and confirm cellular data is available, then go to Settings → On Demand.

What On Demand and Global Routing control

On Demand uses system VPN rules to decide when to establish or stop a tunnel; Global Routing determines how traffic is handled while the tunnel is active. They are not the same switch. In particular, distinguish Disconnect from Direct: the first is a connection action in an On Demand rule, while the second is a traffic routing choice. Switching to Direct does not turn off automatic connections.

For initial troubleshooting, set Global Routing → Config and leave out additional Scene conditions. Even when the system shows a VPN connection, check which policy the actual request matches. The status icon only indicates the tunnel state; it does not prove that a particular domain is routed through a proxy.

Configure Wi-Fi SSIDs: Handle a specific network separately

An SSID is the Wi-Fi network name, not the router's admin address or gateway IP. Find the current network name in the system Settings → Wi-Fi and enter it exactly as shown, checking capitalization, spaces, and punctuation. Similar names are not identical. If the router's network name changes, the old condition will not update automatically.

In Shadowrocket, go to Settings → On Demand and edit the Wi-Fi condition. To stop the tunnel when you return to a specific home network, set the action for that SSID to Disconnect. Specify separately whether to connect on other Wi-Fi networks. Available fields depend on the installed app interface; do not paste the conditions below as Config file syntax.

1. Note the test SSID, such as Home-Study, and confirm the device is connected to that network.
2. Set the action for that SSID to Disconnect. If you have multiple conditions, check the specific SSID condition before the general condition for other Wi-Fi networks to prevent the general condition from matching first.
3. Choose the action for other Wi-Fi networks explicitly; do not assume an unset option inherits the cellular behavior.
4. Save and enable On Demand, confirm the VPN settings when prompted by the system, then switch to another Wi-Fi network and back to the test SSID.

Cellular conditions and two example setups

Cellular conditions apply to Cellular. Do not enter a carrier name or use a Wi-Fi SSID here. To connect automatically after leaving Wi-Fi, set the Cellular action to Connect. On dual-SIM devices, in areas with weak signal, and when Wi-Fi and cellular keep switching, observe whether the network is stable; do not assume every reconnection means your existing connection has failed.

The second setup does not guarantee that existing video calls, file transfers, or long-lived connections will continue uninterrupted when the network changes. The network address, routes, and tunnel may all need to be re-established. During testing, first check whether newly opened web pages load again, then separately determine whether existing apps need to retry their requests.

Domain triggers: Do not confuse them with DOMAIN-SUFFIX

Domain and SSID conditions are evaluated differently. System On Demand domain evaluation typically involves EvaluateConnection and actions such as ConnectIfNeeded and NeverConnect. These relate to name resolution requirements; they do not turn the tunnel on or off immediately for every webpage visited. If the current Settings → On Demand screen does not provide the relevant domain evaluation fields, a domain rule in Config cannot replace them.

ConnectIfNeeded does not mean “always connect when this domain is visited.” The system considers domain matching and resolution conditions to decide whether to establish a VPN. If the domain already resolves normally on the current network, it may not trigger. NeverConnect does not mean “disconnect the existing tunnel when this domain is visited”; it prevents a connection from being initiated for matching resolution requirements. To stop the tunnel, use an appropriate network Disconnect condition or disconnect manually.

• Before testing domain evaluation, disconnect any active connection and make sure no other Wi-Fi or Cellular Connect condition will establish a tunnel first.
• Use a domain you control that meets the test's resolution conditions. example.com is shown only to illustrate the syntax and is not guaranteed to trigger an On Demand connection.
• Browser and app caches, as well as existing connections, may bypass new resolution requests. If one refresh does not trigger a connection, that alone does not prove the rule is broken.
• Follow the matching syntax documented for the domain evaluation field. Do not assume it accepts a DOMAIN-SUFFIX rule or wildcard.

Traffic routing example: Choose a policy only after the tunnel is active

This is a syntax example for [Rule] in Config, not an On Demand configuration. When editing, merge it into the appropriate section of your current configuration and keep any other required content. The connection used by PROXY must also be available. Rules are evaluated from top to bottom; the first match determines the policy.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

DOMAIN-SUFFIX matches domain suffixes. The IP-CIDR example covers the corresponding private address range; GEOIP relies on IP geolocation, and FINAL provides a fallback. None of these establishes a tunnel. Do not treat port 443 as a domain trigger either: the port commonly used by HTTPS and On Demand conditions are separate settings.

Test in order: Change networks, visit a destination, check disconnection

Change one condition at a time and record four things: current network, expected action, actual tunnel state, and whether the destination is accessible. Base results on your own device rather than fixed latency or a fixed wait time for every network. System scheduling, network sign-in, and resolution caches can all affect what you observe.

To stop automatic connections completely for now, turn off On Demand in Settings → On Demand, disconnect the current connection, and check the Connect On Demand status for the relevant VPN configuration in system Settings → General → VPN & Device Management. Menu names may vary slightly by system version. If you disconnect only once from Home but leave a matching automatic connection condition enabled, the tunnel may come back on.

Troubleshooting: Automatic reconnections, domains that do not trigger, and rules that do not work