Build two SSID lists for Shadowrocket On Demand: networks that should auto-raise the tunnel (cellular, travel) and networks that must stay Direct (home, most offices). Invert them and the LAN dies as you walk in the door—that is not a dead node.
iOS will prompt on network changes. Named SSIDs beat tapping the switch on every unlock. Field names follow 3.2.1.
A boring default map
| Network | On Demand |
|---|---|
| Home Wi-Fi | Do not auto; LAN Direct |
| Office | Follow policy; never if VPN is banned |
| Cellular | Auto |
| Hotel / airport | Portal first, then connect |
If On Demand already raised the tunnel, the captive portal never loads. Disable, authenticate, then enable. Frequent drops after that are often an expired sub: update fail. Import: import. Download, FAQ, guides.
Field questions tied to this guide
- On Demand vs Always-On? Always-On fights to keep the tunnel. On Demand keys off SSIDs. Flaky underground radios often want Always-On so you do not forget.
- Home printers vanished. Exclude the home SSID or Direct that LAN. An inverted list stuffs 192.168.x into Proxy.
- With a kill switch? Expected blips during SSID changes. Get the list right before enabling a lock.
- Work Wi-Fi forbids VPNs. Never auto-connect on that SSID. Do not sideload profiles to dodge MDM.
Change one control, then retest
While working through “Shadowrocket On Demand: SSID lists that do not murder your home LAN”, write the download-page version, mode, protocol, and node name on the first line of a note. After each toggle, run one check only: 1.1.1.1/help or the exact page that failed. Changing Kill Switch, split rules, and nodes together makes the next failure un-debuggable. Get Shadowrocket packages only from the download page; permissions and device limits live in the FAQ and guides.
On office or hotel networks, finish captive portals and clear leftover PAC entries before you decide this article’s failure mode applies. A cellular A/B exposes router DNS and parental filters quickly. Avoid hammering login on a second device during the test so session kickouts are not mistaken for radio drops.
Pin the combination that works—SSID, node, protocol—and reuse it on that network instead of starting from Auto every time. Keeping slug rocket-on-demand-connect as your note title makes the write-up searchable later.
When to stop and change layers
After five identical failures, stop. Recheck the documented build, confirm a single tunnel client, ensure Kill Switch was not blocking a portal, and verify the browser is not Direct in a split list. Stopping is how you escape the wrong layer.
When you ask for help, include time, SSID, mode, protocol, node names, and steps already tried. After recovery, verify egress in a clean browser so cache does not fake success, then write the split list or favorites back into your notes before the next reinstall.
Extra pass for “Shadowrocket On Demand: SSID lists that do not murder your home LAN”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket On Demand: SSID lists that do not murder your home LAN”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket On Demand: SSID lists that do not murder your home LAN”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket On Demand: SSID lists that do not murder your home LAN”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket On Demand: SSID lists that do not murder your home LAN”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.