{"slug":"using-vpn-on-demand-for-ios-and-macos","title":"Using VPN On Demand for iOS and macOS","tags":["tailscale","networking"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Using VPN On Demand for iOS and macOS\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nVPN On Demand is currently only available in the iOS and macOS versions of the Tailscale client.\r\n\r\nTailscale 1.48 for iOS was the first version of the Tailscale client to support this feature.\r\nSupport for macOS was added in Tailscale 1.60.\r\n\r\nVPN On Demand is a feature that VPN providers on iOS and macOS can adopt to automate\r\nthe establishment of a VPN connection. When VPN On Demand is used, your device can\r\nautomatically start or stop the Tailscale VPN tunnel based on a number of criteria.\r\n\r\nFor instance, you can create a VPN On Demand configuration that will connect Tailscale\r\nwhen your iPhone leaves your Wi-Fi network, and disconnect once you're back\r\nunder Wi-Fi coverage.\r\n\r\n![The VPN On Demand settings in iOS. 'Connect automatically on' for 'Wi-Fi' selecting 'Only On'.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fvpn-on-demand.a0126dd5.png&w=640&q=75)\r\n\r\n## [Setting up VPN On Demand](https://tailscale.com/docs/features/client/ios-vpn-on-demand\\#setting-up-vpn-on-demand)\r\n\r\nTo set up VPN On Demand:\r\n\r\n[iOS](https://tailscale.com/docs/features/client/ios-vpn-on-demand?tab=ios) [macOS](https://tailscale.com/docs/features/client/ios-vpn-on-demand?tab=macos)\r\n\r\n1. Open the Tailscale app on your iOS device.\r\n2. After logging in, open the settings by tapping on your profile picture on the top right.\r\n3. Tap on **VPN On Demand**. If you don't see this item, your system administrator might have\r\nhidden the VPN On Demand settings, or you might be running an older version of the Tailscale\r\nclient. You should update to a newer version from the App Store.\r\n4. You can now enable VPN On Demand and set up your rule set based on the instructions below.\r\n\r\n### [Choosing your connection rules](https://tailscale.com/docs/features/client/ios-vpn-on-demand\\#choosing-your-connection-rules)\r\n\r\nConnection rules are available for the Wi-Fi, Cellular, and Ethernet interfaces on your device.\r\n\r\nFor Wi-Fi interfaces, you can choose from one of the following options:\r\n\r\n- **Always**: Tailscale will always connect when a Wi-Fi connection is active.\r\n- **Only On**: Tailscale will always connect when a Wi-Fi connection is active, provided that the\r\ncurrent Wi-Fi network is included in the configuration. If the current Wi-Fi network is not in the\r\nlist of included networks, Tailscale will disconnect.\r\n- **Except On**: Tailscale will always connect when a Wi-Fi connection is active, however it will\r\ndisconnect if the current Wi-Fi network is included in the list of excepted networks.\r\n- **Never**: Tailscale will always disconnect when a Wi-Fi connection is active.\r\n- **Do Nothing**: Tailscale won't automatically connect or disconnect, allowing you to manually\r\nmanage the state of the VPN.\r\n\r\nFor Cellular and Ethernet interfaces, you can choose from one of the following options:\r\n\r\n- **Always**: Tailscale will always connect when a cellular data or Ethernet connection is established.\r\n- **Never**: Tailscale will always disconnect when a cellular data or Ethernet connection is established.\r\n- **Do Nothing**: Tailscale won't automatically connect or disconnect, allowing you to manually manage the state\r\nof the VPN.\r\n\r\n### [Using MagicDNS hostname matching](https://tailscale.com/docs/features/client/ios-vpn-on-demand\\#using-magicdns-hostname-matching)\r\n\r\nYou can also use VPN On Demand to automatically connect Tailscale when iOS or macOS detect a connection\r\nto a hostname that ends in `*.ts.net`. This feature is available only when you have set\r\nthe connection rule for an interface to **Do Nothing**. When any other rule is active, MagicDNS matching\r\nwill not be available.\r\n\r\n## [Common issues](https://tailscale.com/docs/features/client/ios-vpn-on-demand\\#common-issues)\r\n\r\nVPN On Demand rules can determine whether the Tailscale app is allowed to establish a VPN on your device,\r\nand if your rules are not set up correctly, they can prevent Tailscale from connecting.\r\n\r\nFor instance, if your rules are set to **Never** for an interface, iOS/macOS will disconnect Tailscale. If you attempt\r\nto reconnect manually, iOS/macOS will immediately disconnect the VPN again. To get out of this state, you must adjust\r\nyour connection rules to allow the connection, or disable VPN On Demand entirely.\r\n\r\nIf you are experiencing any problem or have an enhancement request,\r\n[file a GitHub issue](https://github.com/tailscale/tailscale/issues).\r\n\r\n## [Using other VPNs](https://tailscale.com/docs/features/client/ios-vpn-on-demand\\#using-other-vpns)\r\n\r\nOn both iOS and macOS, you can only have one VPN app with On Demand enabled at any given time. If you connect to\r\nany other VPN while On Demand is enabled for Tailscale, iOS/macOS will disable it for Tailscale\r\nuntil you manually connect Tailscale again. For more information about using other VPNs\r\ntogether with Tailscale, refer to [this entry](https://tailscale.com/docs/reference/faq/other-vpns).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Using VPN On Demand for iOS and macOS

\n

Last validated: Jan 5, 2026

\n

VPN On Demand is currently only available in the iOS and macOS versions of the Tailscale client.

\n

Tailscale 1.48 for iOS was the first version of the Tailscale client to support this feature.\r\nSupport for macOS was added in Tailscale 1.60.

\n

VPN On Demand is a feature that VPN providers on iOS and macOS can adopt to automate\r\nthe establishment of a VPN connection. When VPN On Demand is used, your device can\r\nautomatically start or stop the Tailscale VPN tunnel based on a number of criteria.

\n

For instance, you can create a VPN On Demand configuration that will connect Tailscale\r\nwhen your iPhone leaves your Wi-Fi network, and disconnect once you're back\r\nunder Wi-Fi coverage.

\n

\"The

\n

Setting up VPN On Demand

\n

To set up VPN On Demand:

\n

iOS macOS

\n
    \n
  1. Open the Tailscale app on your iOS device.
    2. \n
  2. After logging in, open the settings by tapping on your profile picture on the top right.
    3. \n
  3. Tap on VPN On Demand. If you don't see this item, your system administrator might have\r\nhidden the VPN On Demand settings, or you might be running an older version of the Tailscale\r\nclient. You should update to a newer version from the App Store.
    4. \n
  4. You can now enable VPN On Demand and set up your rule set based on the instructions below.
    5. \n
\n

Choosing your connection rules

\n

Connection rules are available for the Wi-Fi, Cellular, and Ethernet interfaces on your device.

\n

For Wi-Fi interfaces, you can choose from one of the following options:

\n\n

For Cellular and Ethernet interfaces, you can choose from one of the following options:

\n\n

Using MagicDNS hostname matching

\n

You can also use VPN On Demand to automatically connect Tailscale when iOS or macOS detect a connection\r\nto a hostname that ends in *.ts.net. This feature is available only when you have set\r\nthe connection rule for an interface to Do Nothing. When any other rule is active, MagicDNS matching\r\nwill not be available.

\n

Common issues

\n

VPN On Demand rules can determine whether the Tailscale app is allowed to establish a VPN on your device,\r\nand if your rules are not set up correctly, they can prevent Tailscale from connecting.

\n

For instance, if your rules are set to Never for an interface, iOS/macOS will disconnect Tailscale. If you attempt\r\nto reconnect manually, iOS/macOS will immediately disconnect the VPN again. To get out of this state, you must adjust\r\nyour connection rules to allow the connection, or disable VPN On Demand entirely.

\n

If you are experiencing any problem or have an enhancement request,\r\nfile a GitHub issue.

\n

Using other VPNs

\n

On both iOS and macOS, you can only have one VPN app with On Demand enabled at any given time. If you connect to\r\nany other VPN while On Demand is enabled for Tailscale, iOS/macOS will disable it for Tailscale\r\nuntil you manually connect Tailscale again. For more information about using other VPNs\r\ntogether with Tailscale, refer to this entry.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}