On-demand VPN on non‑trusted / public Wi‑Fi

[lakemike]

Summary

Add an option in the Pangolin client to automatically connect/enable the tunnel when the device joins any Wi‑Fi network that is not explicitly marked as “trusted” (e.g., home), similar to WireGuard’s on-demand behavior for public Wi‑Fi.

Motivation

I’d like to move my setup (and my family’s phones) to the new Pangolin client, but the main blocker is lack of “auto-connect on public Wi‑Fi”.

Today, WireGuard can automatically turn on whenever I connect to any Wi‑Fi network other than my home SSID. This provides a simple, reliable safety net when joining unknown networks (cafes, hotels, airports, etc.). I’d like Pangolin to support the same workflow. This use case keeps me from switching to pangolin client, because I can have only one VPN provider activated in iOS.

Proposed Solution

Provide a client-side feature such as:

• Auto-connect rule: Auto-connect when on any Wi‑Fi network not in the trusted list (i.e., “public Wi‑Fi mode”).
• Trusted Wi‑Fi list (SSIDs): Mark one or more SSIDs as trusted (e.g., “HomeWiFi”).
• Route all traffic through VPN when connected, in addition to making private resources available

Outcome:

• When connected to a trusted SSID → Pangolin remains disconnected but still offers to make private resources available
• When connected to an untrusted/new SSID → Pangolin automatically connects and routes all traffic through VPN

Alternatives Considered

No response

Additional Context

No response