Connecting automatically

Rules that bring the tunnel up on the networks where you want it.

Why rules rather than a switch

A VPN you have to remember to turn on is off precisely when it matters — on the café Wi-Fi you joined while reading something else. Rules move that decision from your memory to the device.

One connection carries these rules at a time. Arming another moves them; it does not add a second set.

What a rule can look at

• A specific Wi-Fi network, matched by name.
• Cellular, as a category, on iPhone and iPad. A Mac has no cellular radio, so a cellular rule has no effect there — including on a connection that arrived from another device.

So a connection can come up on every network except your home Wi-Fi, or only on the office network, or whenever you are on cellular.

What the system asks first

On-demand rules belong to the same VPN configuration you approved when you added the connection. iPhone and iPad show a VPN indicator whenever a tunnel is up, including one a rule brought up; the Mac shows it in the menu bar. The system never lets an app connect silently, and that is deliberate.

When a rule seems not to fire

Wi-Fi names are matched exactly. Office and Office 5G read the same to you and are two different names to the rule.