On-Demand Rules / Trusted Network Auto-Disconnect for iOS/macOS Client

[davidgatti]

Summary

Add the ability to configure trusted WiFi networks (SSIDs) where the Pangolin VPN automatically disconnects, and automatically reconnects when leaving those networks or switching to cellular.

Motivation

When using Pangolin to access home services remotely (e.g. Jellyfin, Pi-hole), the VPN works great on the go. But when I return home and connect to my home WiFi, the VPN tunnel stays active. Traffic then loops through the relay server (phone → AWS → back home) instead of going directly on LAN, causing all network requests to fail or time out. I have to manually disconnect every time I get home, and manually reconnect when I leave. This makes the experience frustrating for daily use.

Proposed Solution

Add an "On-Demand Rules" or "Trusted Networks" section in the iOS/macOS client settings:

• Trusted SSIDs: User defines WiFi networks where the VPN should automatically disconnect (e.g. home WiFi)
• Behavior on cellular: Option to auto-connect when on mobile data
• Behavior on untrusted WiFi: Option to auto-connect on any WiFi not in the trusted list

iOS already supports this natively via NEOnDemandRule (NEOnDemandRuleDisconnect, NEOnDemandRuleConnect, NEOnDemandRuleEvaluateConnection) in the Network Extension framework. The official WireGuard iOS app implements this exact feature, so the underlying API support is already there since Pangolin uses WireGuard under the hood.

Alternatives Considered

• iOS Shortcuts automation ("When I join WiFi X, disconnect VPN") — works but is unreliable, requires confirmation taps, and doesn't cover all edge cases like WiFi drops
• Leaving the VPN disconnected and manually connecting when needed — defeats the purpose of seamless remote access
• Using split-tunnel to exclude local traffic — doesn't solve the DNS conflict and still routes unnecessarily through the relay

Additional Context

• Tested on iPhone XR, Pangolin iOS v0.6.3, Pangolin server v1.16.2
• Use case: self-hosted homelab with private resources (Jellyfin, Pi-hole) accessed via Newt tunnel through an AWS EC2 relay
• This is a common feature in VPN clients (WireGuard, Tailscale, OpenVPN Connect all support it)
• Apple developer reference: NEOnDemandRule