Ok thank you for the explanations. That confirms what I thought. .any is the default value for onDemandRule.interfaceTypeMatch so even if I not initialize it’s value, the result is the same. So how can we do to have a VPN which connect automatically and some websites which not to go through the VPN in same time? I don’t see how can we do using onDemand configuration. Maybe by another means?