Skip to main content

On-Demand Rules and Split DNS: Automatic VPN Without the Overhead

Jacky LiangJacky Liang

Automate tunnel activation and route only selected DNS queries through the VPN with Vylos On-Demand rules and Split DNS.

Vylos 1.2.0 adds on-demand activation rules and split DNS to solve both problems.

On-Demand Activation

On-demand rules tell Vylos when to automatically connect or disconnect a tunnel based on network conditions. No manual toggling required.

Each tunnel can be configured with rules for two network types:

  • Cellular (iOS) or Ethernet (macOS) — Automatically connect when on cellular data or a wired connection
  • Wi-Fi — Four modes:
    • Off — No automatic activation on Wi-Fi
    • Any SSID — Connect on any Wi-Fi network
    • Only these SSIDs — Connect only on specific networks (whitelist)
    • Except these SSIDs — Connect on all Wi-Fi except specific networks (blacklist)

The SSID-based modes are particularly useful for organizations. "Only these SSIDs" activates the VPN on office Wi-Fi but not on employees' home networks.

"Except these SSIDs" does the opposite: the VPN stays on everywhere except a trusted corporate network where traffic is already routed internally.

Clash Detection

When multiple tunnels have on-demand rules enabled, they can conflict. Two tunnels both set to activate on cellular data, or two tunnels that both claim the same SSID — the result is unpredictable.

Vylos detects four types of overlap:

  • Cellular or Ethernet overlap
  • Wi-Fi "Any SSID" overlap
  • Specific SSID overlap (two tunnels claiming the same network name)
  • Broad Wi-Fi overlap (one tunnel on "Any" conflicting with another on specific SSIDs)

When a clash is detected, Vylos displays a warning so administrators or users can resolve the conflict before it causes unexpected behavior. The warning is informational — it does not prevent the configuration from being saved.

Split DNS

Standard VPN configurations route all DNS queries through the tunnel. This means every DNS lookup, even for public services, goes through the VPN server.

Organizations with a few internal hostnames can avoid routing unrelated DNS queries through the tunnel.

Split DNS changes that. Each tunnel can be configured with two sets of domains:

Match Domains — DNS queries for these specific domains are routed through the tunnel. Everything else uses the device's default DNS.

For example, setting corp.example.com as a match domain means only queries for that domain and its subdomains go through the VPN.

Search Domains — Appended to bare hostname queries. If a user types intranet in a browser, the device appends the search domain to try intranet.example.com, which then resolves through the tunnel's DNS.

The result is that internal resources are reachable through the VPN while external traffic flows normally. This reduces load on the VPN server and improves performance for everything that doesn't need tunnel access.

The Vylos File Format

Standard WireGuard .conf files don't support on-demand rules or split DNS — those features simply don't exist in the WireGuard configuration spec. Rather than mixing custom fields into the .conf format, which would break compatibility with other WireGuard clients, we created the .vylos format.

A .vylos file is a ZIP archive that bundles the standard WireGuard .conf file alongside a separate settings file for On-Demand rules and Split DNS. The WireGuard configuration stays untouched, while the additional settings live in their own file.

This keeps the formats interoperable. A .conf exported from Vylos works in any WireGuard-compatible client.

A .vylos file carries the full configuration, including On-Demand and Split DNS, for Vylos to read.

Export supports three format options: .conf only, .vylos only, or both.

See Vylos File Format for the archive layout and settings schema.

Getting Started

On-demand rules and split DNS are available in Vylos 1.2.0 for iOS, macOS, and visionOS. Configure them per-tunnel through the tunnel edit form, or push them via MDM through managed tunnel configurations.

See the user guide for configuration details and the admin guide for MDM deployment options.