Is it possible to bring up or tear down an iOS OnDemand tunnel based on a site accessed by mobile device?
This however suffers from the fact that resolving the domain name first fails, causing the initial page load to fail in Safari. After a page reload the page is shown, and the tunnel is brought up. This happens even if instead of 127.0.0.1 a real, working behind-the-tunnel DNS server address is provided. Is there a way to not fail the initial lookup?


If you are using a real DNS server, the initial lookup will not fail on iOS 9.2. It is a bug introduced from iOS 9.3 and Apple haven't fixed it on iOS 9.3.2 release version.

iOS 9.3 beta VPN On Demand ignores useDNSServers