People search iOS VPN On Demand because a blog, an IT person, or a competitor settings screenshot used those two words like a consumer feature. On an iPhone they are usually Apple's words. They live in a VPN payload, in MDM, in a .mobileconfig someone else wrote. The OS evaluates rules when the network changes. Connect. Disconnect. Ignore. Sometimes evaluate a hostname. That is not the same object as a big Connect button, and it is not the same object as an in-app auto-connect switch.
This is not the VPN on iPhone: Quick Setup. That piece is App Store, Allow, first handshake. This assumes the app already works. It is also not the generic VPN Auto-Connect: When to Use It essay, which is habits across platforms. It is not Android Always-On VPN: When to Use It. Android has a system checkbox named that. iOS does not give you the same labeled lock. It is not the Apple VPN Entitlements for a White-Label Brand. That is operator paperwork. You are a person with a phone.
A VPN is still a tunnel. Wikipedia's VPN page will not write your SSID list. RFC 8446 will not either. Apple's deployment guide on VPN On Demand will. Read that if you actually have a profile. If you only have a consumer app, you probably do not.
Klox does not document a consumer toggle named On Demand. I looked. What we do document is Smart Connect: connect automatically on untrusted Wi-Fi. If the Klox iOS app exposes connect-on-Wi-Fi / auto-connect, use that. Apple On Demand rules live in VPN profiles and MDM. Consumer apps often wrap a simpler toggle and never show you the array.
Klox consumer is WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, yearly from $2.83 a month, seven-day money-back on first purchase. The iPhone is one of those five when the tunnel is up. On Demand, auto-connect, or a forgotten always-connected session does not create a sixth seat. It occupies the one you already have, including at 2 a.m. with the screen off.
I have a bias. Travel phone: auto-connect on untrusted Wi-Fi if the app offers it. Manual on a home iPad that never leaves. Do not import a work On Demand profile onto the same phone as the consumer app and hope. Hotels will still win if you cannot find the off path.
Related reading: What is a VPN? and Download KloxVPN. Android VPN setup and iOS VPN setup.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
On Demand is Apple's language, not a Klox product name
Apple's docs are blunt. VPN On Demand lets the device start or stop a tunnel from rules, without you tapping Connect every time the SSID changes. Classic MDM story: certificate auth, no password prompt, OnDemandRules in the VPN payload. Network detection when the primary interface changes. Connection evaluation when something asks for a name. First matching rule wins.
That is a policy language. IT writes it. The phone obeys it. You, on a consumer Klox account, are usually not editing that plist. You are looking at an app that asked iOS for a VPN configuration, you tapped Allow, and now there is a status-bar VPN glyph when the tunnel is up.
Competitor blogs will say always-on iPhone as if it were one switch. Some of them mean auto-connect on Wi-Fi. Some mean never disconnect. Some mean a kill switch. Apple means On Demand rules. Mixing the four is how you get a hotel lobby with full bars and a browser that will not load the agree-to-terms page.
- 1Download the app from klox.app/download — not a random APK site.
- 2Sign in with the account you paid for.
- 3Press WireGuard. Wait for the connected state.
- 4If it fails, try OpenVPN. Still failing: note the network (hotel, campus, home) before you write support.
First successful connect
| Mode | Who starts the tunnel | Hotel / airport portal | Cellular |
|---|---|---|---|
| Manual Connect | You tap | Usually fine | Stays off until you tap |
| In-app auto-connect / Smart Connect | App, often on untrusted Wi-Fi | Usually fine | Only if that toggle includes cellular |
| Apple On Demand (profile / MDM) | iOS evaluates OnDemandRules | Can starve the splash page | Can Connect or Disconnect by interface type |
| Leave it connected forever | Nobody; it never dropped | Often fights the portal | Uses data and a device seat overnight |
On Demand is a profile language. A consumer app usually hands you a simpler switch and hopes you never meet a hotel portal.
— KloxVPN consumer notes
Cloudflare Learning: What is a VPN?
If you cannot see a rule list, you do not have On Demand
Settings, General, VPN and Device Management, a configuration profile with a VPN payload: that is the MDM/profile world. An app with Connect and a settings row that says auto-connect or connect on Wi-Fi: that is the consumer world. Do not rename the second one On Demand in your head. You will search the wrong help article at 11 p.m.
Smart Connect is the Klox sentence that actually exists
On the features page we say connect automatically on untrusted Wi-Fi. That is the mapping. If your iOS build shows a similar row, that is the switch to argue with. I will not invent a second label in this article so it ranks for Apple's noun.
Tap, auto-connect, and On Demand rules are three jobs
Manual: you decide. You forget on cafe Wi-Fi. That is the whole risk. Auto-connect in the app: the client tries when you join a network it thinks is untrusted, or when the app wakes. Useful. Incomplete if iOS suspended the extension, if you denied the VPN dialog after an update, or if a leftover work profile owns the slot.
On Demand: iOS itself evaluates. MDM loves this because the user cannot be trusted to tap. The cost is the user also cannot be trusted to debug a rule that Connects on every unknown Wi-Fi, including the captive SSID that is not the internet yet.
Pick a job. Travel iPhone that sees random SSIDs: auto-connect on untrusted Wi-Fi if the app has it. Shared family iPad on home Wi-Fi: manual. Company iPhone: whatever MDM already installed, and do not stack Klox on top without asking IT.
Untrusted is a list, not a vibe
If the app lets you mark home as trusted, mark home. If it does not, auto-connect on all Wi-Fi will fire on your own router. That is not a crime. It is a printer that disappears and a HomeKit accessory that sulks. Split tunnel on iOS is not our consumer story. The iOS page says the app encrypts all traffic when connected. Per-app exceptions live on Android and desktop. On iPhone, trusted SSID or disconnect is the local-LAN move.
App launch auto-connect is a weaker cousin
Connect when you open the VPN app still requires you to open the VPN app. That is a reminder, not a policy. Fine for someone who already has the habit. Useless for the person who joins airport Wi-Fi and opens Maps first.
Wi-Fi versus cellular: when the rule fights the radio
Apple's own On Demand examples include start on Wi-Fi, stop on cellular. That is a real configuration. It is also how people burn a hotel day on the tunnel and then wonder why the phone used two gigabytes of LTE in the Uber because a Disconnect-on-cellular rule never existed, or the consumer auto-connect included mobile data and they did not notice.
Cellular is not a cafe AP. Your carrier already sits on the path. A tunnel still hides destinations from that carrier the way it does on Wi-Fi. It also still uses the plan's data, plus protocol overhead. If you are on a thin roaming pack, always-connected cellular is a bill, not a personality.
Wi-Fi is where On Demand and auto-connect earn their keep: SSIDs you do not run. Cellular is where I usually want a choice. If the Klox iOS auto-connect row is Wi-Fi only, that is the setting I want for most people. If it is all networks, know that before you board.
Wi-Fi calling and the tunnel
Some carriers get weird when a VPN owns the default route and you expect Wi-Fi calling to look like a native call. If calls drop only with the tunnel up, disconnect for the call. Voice is allowed to win. Put the privacy habit back after. I will not pretend every carrier stack loves a packet tunnel.
Switching radios is the leak window people forget
Cafe to LTE. Hotel to LTE. The glyph flickers. A few packets can leave on the new path before the tunnel is back. An in-app kill switch tries to cover that. On Demand Connect on the new interface tries to cover that. Neither is magic if the extension is waiting on a handshake. Test by toggling airplane mode at home, not in a boarding line. If you care, read the kill-switch piece after you finish this one. This page is when the start policy fights the radio, not the leak physics.
Captive portals: the lobby page that never loads
Hotel, airport, some trains, some guest networks: associate, then a local page that wants Accept or a room number. That page is not the internet. It is a host on the LAN. A VPN that is already connecting, or a rule that says Connect on this unknown Wi-Fi, sends your browser toward a tunnel that has nowhere to go yet. The splash never renders. You blame the brand. The brand did what the rule said.
This is the same failure class as Android Block connections without VPN, with different labels. On iPhone the fix is: disconnect the VPN (or disable the On Demand profile's connect behavior if you actually have MDM), load the portal, then reconnect. If you cannot find disconnect, you will sit in the lobby with a full signal and a dead Safari.
Practice once on a cafe that uses a splash page. Screenshot the path: app disconnect, Settings VPN toggle if the app is stuck, then portal, then connect. Put the screenshots in Photos. Hotels are a bad classroom.
Use cellular to finish the portal if you must
If Wi-Fi is hostage and the VPN will not let go, turn on cellular, disconnect the tunnel, complete the Wi-Fi login, reconnect. Clumsy. Beats asking the front desk why the internet is broken while they point at a QR code you cannot reach.
Personal hotspot from the iPhone
If this phone is the hotspot for a laptop, the VPN on the phone can eat the laptop's path or confuse the share. Test at home. Some people VPN on the laptop and leave the phone as a dumb modem. That uses two of five seats if both run Klox. Pick. The family seating article is the longer version. Here: On Demand on the hotspot phone is how you get a laptop that cannot complete a hotel portal either.
Always-on is an Android phrase people paste onto iPhone
Android Settings lets you pin Always-on VPN and optionally block connections without VPN. That lock is why the Android article exists. iOS does not give consumers the same two checkboxes with those names. People still say always-on iPhone because competitor help pages taught them to.
On iPhone, always-on usually means: I never tap Disconnect, and auto-connect brings it back after a drop. That is a habit plus a switch. It is not an OS lockdown that drops every packet when the tunnel dies. If you need fail-closed, look at what the app's kill switch actually does on iOS, and test it. Do not assume Apple On Demand Disconnect rules are a kill switch. Disconnect means the tunnel goes down. Traffic can then go clear unless something else blocks it.
If a work iPhone has Always-on language in an MDM screenshot, that is the profile. Do not fight it with a second consumer VPN. iOS is one device-wide VPN. The second app will fail or steal the slot. Ask IT. Fighting MDM is how you get a conversation you did not want.
The status bar glyph is not a lock
VPN in the status bar means a configuration is active. It does not mean every flow is inside WireGuard. It does not mean the kill switch fired. Open the app. If the app says disconnected and the glyph is still there, you have a leftover profile. Remove it.
Low Power Mode is not a VPN setting
Low Power Mode can delay background work. A tunnel that needs to reconnect after Wi-Fi hops may sit longer. If the phone is at 12% in a terminal, expect a slower handshake. Charge. Then reconnect. Do not declare the protocol dead.
Battery: reconnect storms, not VPNs drain phones
A quiet WireGuard session on a stable network is a dull line. A cliff is usually the radio bouncing: bad hotel Wi-Fi, elevator, underground platform, the phone hopping between two SSIDs named Guest and Guest_5G. Each hop can tear the tunnel. Each tear can mean a new handshake. Handshakes wake radios. Radios cost battery. People screenshot the battery graph, blame the VPN brand, and uninstall. The graph was the lobby AP.
On Demand Connect on every Wi-Fi change makes that worse if the building has six SSIDs. Manual on a flaky network can be calmer: connect once after the portal, leave it, stop roaming between guest networks.
OpenVPN on a rude network can cost more CPU than WireGuard on a calm one. If the phone is hot, switch protocol before you write a one-star. If it is still hot, the radio is the story. Airplane mode, then Wi-Fi only, is a diagnostic, not a lifestyle.
Background App Refresh is a side character
Killing the VPN app from the app switcher does not always kill the tunnel extension. Good. Force-closing it as a battery ritual can delay reconnect. If you need the tunnel, leave the configuration installed. If you need battery, disconnect on purpose, do not random-kill the process and then surprise yourself on cellular.
Screen off still counts as a device
iOS will keep a VPN up while the phone is in a pocket. That is the point of a travel phone. It is also a seat on the five-device plan. Families treat sleep as off. The account does not.
Five devices and the iPhone that never hangs up
Klox consumer is five concurrent devices. An iPhone with auto-connect on untrusted Wi-Fi, plus a tunnel that never drops on cellular, is one seat all day. Add an iPad with the same habit. Add a Mac. You are at three before the laptop at homework time. The error is not On Demand is broken. The error is we overbooked the car.
Rank: the iPhone that leaves the house gets the automatic habit. The home iPad can stay manual. The old iPhone in a drawer still connected is a ghost seat. Remove it in the portal. Sign out. A traded-in phone you forgot to wipe is how a stranger holds a slot.
Download installs. Pricing is five seats, from $2.83 a month on yearly. On Demand will not change the price. It will change whether the pocket iPhone is still sitting down at 2 a.m.
iPad as furniture
If the iPad never leaves home Wi-Fi, I would not put aggressive auto-connect on it. You get a seat used for recipes. The travel iPhone should win that argument. Kids' iPads that auto-connect on school Wi-Fi will also fight captive portals and MDM. School wins. Do not stack.
Do not share the login to make six
On Demand and auto-connect make shared logins worse because the extra device never drops. Five is the product. Live inside it. A second account is rarely the answer I want. A seating chart is.
WireGuard versus OpenVPN when UDP is rude
On Demand and auto-connect start a tunnel. They do not pick a protocol that the hotel firewall likes. WireGuard is what I want on a normal network. It is lighter. When UDP is blocked, filtered, or so lossy the handshake never finishes, OpenVPN (TCP on a network that only understands HTTPS-shaped traffic) is the spare tire.
If auto-connect keeps spinning on a guest SSID, disconnect, complete the portal, try WireGuard once. If it dies, switch to OpenVPN, then reconnect. Do not sit in Connecting for ten minutes while the rule retriggers. The rule is not the protocol.
I will not invent a success rate. Hotel APs are not a lab. If both protocols fail, the network is the problem, or the account is at five devices, or you never finished the splash page. Sequence those. Protocol last is how people waste the evening. Portal first, then protocol, then city if you have a reason to change city. Nearby is the default. Far is a choice.
UDP-rude is not China policy
A conference AP that breaks UDP is a broken AP. It is not a national firewall essay. Try OpenVPN. If you are actually going somewhere that interferes with VPNs, that is a different trip and a different amount of homework. Do it at home. This article is iPhone start policy, not a circumvention manual.
Do not auto-connect into a protocol you have not tested
First successful connect at home should include a protocol you can find again. If OpenVPN is buried, find it before you need it. Auto-connect that only ever tries a UDP path will look like On Demand is broken when the path is the problem.
Work profiles, leftover configs, two VPNs that cannot share
iOS allows one active device VPN. A work profile, a university profile, a leftover IKEv2 you typed in Settings in 2019, and the Klox app are not a stack. They are a fight. The symptom is: tap Connect, nothing, or the work VPN steals the glyph, or On Demand from MDM brings up the office tunnel on cafe Wi-Fi and your personal traffic goes to a place you did not pick.
Settings, General, VPN and Device Management. Read the list. Delete what you do not need and are allowed to delete. If the work profile is managed, you are not allowed. Use the work tunnel for work. Use a personal phone for Klox, or ask IT whether a personal tunnel is permitted. I will not tell you to hide a consumer VPN from an employer-owned device.
After an iOS update, the Allow dialog can return
App update, iOS update, reset VPN configuration in the app: iOS may ask again. If you Deny, auto-connect and On Demand have nothing to start. The phone looks fine. The tunnel is gone. Grant it on a network you already own, not in a boarding line.
Personal VPN in Settings is not Klox
Someone's old L2TP or IKEv2 row can still be On Demand from a profile you forgot. If the glyph appears without opening Klox, that is the leftover. Remove it. Then open the app. Then connect. Then decide auto-connect.
When manual is the adult setting
Home-only iPad. Phone that must join a work or school portal every morning. Anyone who cannot find Disconnect. Anyone whose banking app explodes on a tunnel and who banks on that same phone all day. Anyone who uses a flaky building SSID where reconnect storms cook the battery.
Manual plus a habit still beats a rule the owner will disable forever after one hotel. I would rather a traveler who connects on SSIDs they do not trust than a traveler who turned everything off in Frankfurt and never turned it back on.
If you travel twice a year, manual is fine. If you live in airports, auto-connect on untrusted Wi-Fi is the point. On Demand as MDM is for fleets. You are probably not a fleet.
Banking apps and the off path
Some banks dislike datacenter IPs. Practice disconnect, complete the login, reconnect. If that is too annoying, bank on a device you leave manual. I will not tell you to break a bank's rules. I will tell you to pick a phone role before you turn every start policy on.
Local printers and HomeKit
Full-tunnel iOS means the printer is on the other side of a VPN exit unless the client has a local-network exception I will not invent. Disconnect at home if you need LAN. Or do not auto-connect on the home SSID. That is the whole local-access story on iPhone without split tunnel.
A rule of thumb for one iPhone
Install from the download page, not a random profile site. Finish the VPN on iPhone: Quick Setup first if you have not. Then: mark home trusted if the app lets you. Turn on auto-connect / connect-on-Wi-Fi / Smart Connect for untrusted Wi-Fi if the row exists. Leave cellular manual unless you have a reason. Learn Disconnect for portals. WireGuard until the network is rude, then OpenVPN. Count the iPhone as one of five whenever the glyph is up.
If your phone is MDM-managed, read the profile. Do not add a second tunnel. If you came here because a competitor said always-on iPhone, you now know which noun they borrowed. Apple On Demand is rules. The Klox consumer mapping is the simpler Wi-Fi auto-connect if the iOS app exposes it.
Price is on pricing: from $2.83 a month yearly, five devices, seven-day money-back. A start policy will not change the SKU. It will change whether the lobby page loads and whether a sleeping iPhone still occupies a seat.
Practice the portal dance once
This weekend: join a splash-page network, disconnect, accept, reconnect. If you cannot do it in two minutes, do not enable aggressive auto-start before a trip. Muscle memory. Terminals are a bad classroom.
What I will not promise
That On Demand makes you anonymous. That it replaces a password manager. That it unlocks a streaming catalog. A tunnel wraps the path. A start policy wraps forgetfulness. The rest of privacy is still your job.
Key Takeaways
Apple VPN On Demand is a profile and MDM rule engine. Connect, Disconnect, Ignore, evaluate a name. Consumer apps wrap a simpler auto-connect, often on untrusted Wi-Fi. Klox documents that idea as Smart Connect, not as a toggle named On Demand. If the iOS app exposes connect-on-Wi-Fi / auto-connect, use that. If you only have a tap, use the tap on SSIDs you do not run.
Hotels will fight any start policy that grabs the route before the splash page. Cellular is a bill and a carrier path, not a cafe. Battery cliffs are usually reconnect storms. Five devices still means five, and a pocket iPhone with the tunnel up is one.
WireGuard when the network is normal. OpenVPN when UDP is rude. One VPN at a time on iOS. Download the app, then pick a start policy on purpose. Do not paste Android Always-on onto an iPhone and expect the same lock.
Related Resources
Put auto-connect on the iPhone that actually leaves the house
KloxVPN: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, from $2.83/month on yearly, seven-day money-back. Download the iOS app, then decide connect-on-Wi-Fi for untrusted networks. Apple On Demand stays a profile language unless MDM already gave you one.
Download KloxVPNFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.