<!--
{
  "availability" : [
    "iOS: 8.0.0 -",
    "iPadOS: 8.0.0 -",
    "macCatalyst: 13.1.0 -",
    "macOS: 10.11.0 -",
    "tvOS: 17.0.0 -",
    "visionOS: 1.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "NetworkExtension",
  "identifier" : "/documentation/NetworkExtension/NEOnDemandRule",
  "metadataVersion" : "0.1.0",
  "role" : "Class",
  "symbol" : {
    "kind" : "Class",
    "modules" : [
      "Network Extension"
    ],
    "preciseIdentifier" : "c:objc(cs)NEOnDemandRule"
  },
  "title" : "NEOnDemandRule"
}
-->

# NEOnDemandRule

A base class shared by all VPN On Demand rules.

```
class NEOnDemandRule
```

## Overview

Each rule is defined by a single action and a set of optional matching conditions. The action defines how the system should trigger the VPN when the conditions are met, such as connecting automatically for all connections, connecting conditionally, or disconnecting. The optional conditions describe parameters of a network. Some common rules include disconnecting the VPN on a trusted, internal network, and triggering on all other networks. When rules are defined in an array, they are evaluated in order and the action of the first rule to match all conditions is chosen.

Instances of the `NEOnDemandRule` class should be created through one of its subclasses: [`NEOnDemandRuleConnect`](/documentation/NetworkExtension/NEOnDemandRuleConnect), [`NEOnDemandRuleDisconnect`](/documentation/NetworkExtension/NEOnDemandRuleDisconnect), [`NEOnDemandRuleEvaluateConnection`](/documentation/NetworkExtension/NEOnDemandRuleEvaluateConnection), or [`NEOnDemandRuleIgnore`](/documentation/NetworkExtension/NEOnDemandRuleIgnore).

## Topics

### Accessing match parameters

[`DNSSearchDomainMatch`](/documentation/NetworkExtension/NEOnDemandRule/dnsSearchDomainMatch)

DNS search domains that identify a network.

[`DNSServerAddressMatch`](/documentation/NetworkExtension/NEOnDemandRule/dnsServerAddressMatch)

DNS server addresses that identify a network.

[`interfaceTypeMatch`](/documentation/NetworkExtension/NEOnDemandRule/interfaceTypeMatch)

An interface type to identify a network.

[`NEOnDemandRuleInterfaceType`](/documentation/NetworkExtension/NEOnDemandRuleInterfaceType)

[`SSIDMatch`](/documentation/NetworkExtension/NEOnDemandRule/ssidMatch)

SSIDs that identify a network.

[`probeURL`](/documentation/NetworkExtension/NEOnDemandRule/probeURL)

A URL to probe when all other network identifiers match to validate that an expected resource is available.

### Accessing the rule action

[`action`](/documentation/NetworkExtension/NEOnDemandRule/action)

The action of the On Demand Rule.

[`NEOnDemandRuleAction`](/documentation/NetworkExtension/NEOnDemandRuleAction)

## Relationships

### Conforms To

[`CustomStringConvertible`](/documentation/Swift/CustomStringConvertible)

[`NSCopying`](/documentation/Foundation/NSCopying)

[`Equatable`](/documentation/Swift/Equatable)

[`CustomDebugStringConvertible`](/documentation/Swift/CustomDebugStringConvertible)

[`NSObjectProtocol`](/documentation/ObjectiveC/NSObjectProtocol)

[`NSCoding`](/documentation/Foundation/NSCoding)

[`NSSecureCoding`](/documentation/Foundation/NSSecureCoding)

[`CVarArg`](/documentation/Swift/CVarArg)

[`Hashable`](/documentation/Swift/Hashable)

### Inherited By

[`NEOnDemandRuleIgnore`](/documentation/NetworkExtension/NEOnDemandRuleIgnore)

[`NEOnDemandRuleConnect`](/documentation/NetworkExtension/NEOnDemandRuleConnect)

[`NEOnDemandRuleDisconnect`](/documentation/NetworkExtension/NEOnDemandRuleDisconnect)

[`NEOnDemandRuleEvaluateConnection`](/documentation/NetworkExtension/NEOnDemandRuleEvaluateConnection)

### Inherits From

[`NSObject-swift.class`](/documentation/ObjectiveC/NSObject-swift.class)

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)