<!--
{
  "availability" : [
    "iOS: 8.0.0 -",
    "iPadOS: 8.0.0 -",
    "macCatalyst: 13.1.0 -",
    "macOS: 10.11.0 -",
    "tvOS: 17.0.0 -",
    "visionOS: 1.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "NetworkExtension",
  "identifier" : "/documentation/NetworkExtension/NEOnDemandRuleEvaluateConnection/connectionRules",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Property",
  "symbol" : {
    "kind" : "Instance Property",
    "modules" : [
      "Network Extension"
    ],
    "preciseIdentifier" : "c:objc(cs)NEOnDemandRuleEvaluateConnection(py)connectionRules"
  },
  "title" : "connectionRules"
}
-->

# connectionRules

An array of [`NEEvaluateConnectionRule`](/documentation/NetworkExtension/NEEvaluateConnectionRule) objects

```
var connectionRules: [NEEvaluateConnectionRule]? { get set }
```

## Discussion

Each `NEEvaluateConnectionRule` object defines a behavior to take for connections that match the domain of the rule. Each rule is evaluated in order against the properties of a network connection being established. An example configuration has two connection rules: a rule matching `myserver.example.com` with the domain action [`NEEvaluateConnectionRuleAction.neverConnect`](/documentation/NetworkExtension/NEEvaluateConnectionRuleAction/neverConnect), followed by a rule matching `example.com` with the domain action [`NEEvaluateConnectionRuleAction.connectIfNeeded`](/documentation/NetworkExtension/NEEvaluateConnectionRuleAction/connectIfNeeded). This configuration would cause all connections to hostnames in `example.com` that do not resolve on the current network to trigger the VPN, except for `myserver.example.com`.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)