Thanks Matt for your reply. I tried the mentioned connection and disconnection rules and on demand rules works perfectly fine with interface match. Below code works perfectly fine: var rules = [NEOnDemandRule]() let rule = NEOnDemandRuleConnect() or let rule = NEOnDemandRuleDisconnect() rule.interfaceTypeMatch = .anyrules.append(rule) manager.onDemandRules = rules manager.isOnDemandEnabled = true But the functionality which i am looking is to disconnect from the tunnel when user browse/navigates to hostname like netflix, primevideo and that is not working. Code not working: Swift var rules = [NEOnDemandRule]() let rule = NEOnDemandRuleConnect() rule.interfaceTypeMatch = .any rule.dnsSearchDomainMatch = ["*.hotstar.com", "*.netflix.com", "*.primevideo.com"]   rule.probeURL = NSURL(string: "url.accessible.from.internal") as URL? rules.append(rule) manager.onDemandRules = rules manager.isOnDemandEnabled = true