iOS On-Demand VPN with Wi-Fi SSID Exclusions

[goppinath]

Summary

Add support for iOS On-Demand VPN with Wi-Fi SSID exclusions, similar to the native WireGuard iOS app.

Motivation

Currently, Pangolin’s VPN activates on all networks. Many users connect to home or office Wi-Fi, which provides local access and does not need the VPN.
Without exclusions, VPN connects unnecessarily, increasing battery usage and latency. WireGuard already supports this, so users expect the same.

Proposed Solution

Allow SSID-based exclusions in VPN settings:

• On-Demand VPN toggle
• Connect on Wi-Fi and Cellular
• Except these Wi-Fi SSIDs: user can add trusted networks

Expected behavior:

• Excluded SSID → VPN off
• Unknown Wi-Fi or Cellular → VPN on

Alternatives Considered

• Manual VPN activation (error-prone)
• Global iOS VPN toggle (no SSID rules)
• Using another VPN app like WireGuard (loses Pangolin features)

Additional Context

• iOS supports this via NEVPNManager rules
• Prevents breaking local network services (printers, NAS, servers)
• Improves battery life, UX, and trust while keeping protection for untrusted networks