diff --git a/WireGuard/WireGuard/VPN/TunnelsManager.swift b/WireGuard/WireGuard/VPN/TunnelsManager.swift
index 8827ea3..8eb2112 100644
--- a/WireGuard/WireGuard/VPN/TunnelsManager.swift
+++ b/WireGuard/WireGuard/VPN/TunnelsManager.swift
@@ -72,6 +72,14 @@ class TunnelsManager {
         tunnelProviderManager.localizedDescription = tunnelName
         tunnelProviderManager.isEnabled = true
 
+        if (tunnelConfiguration.activationType == .activateManually) {
+            tunnelProviderManager.onDemandRules = []
+            tunnelProviderManager.isOnDemandEnabled = false
+        } else {
+            tunnelProviderManager.onDemandRules = onDemandRules(for: tunnelConfiguration.activationType)
+            tunnelProviderManager.isOnDemandEnabled = true
+        }
+
         tunnelProviderManager.saveToPreferences { [weak self] (error) in
             defer { self?.isAddingTunnel = false }
             guard (error == nil) else {
@@ -130,6 +138,14 @@ class TunnelsManager {
         tunnelProviderManager.localizedDescription = tunnelName
         tunnelProviderManager.isEnabled = true
 
+        if (tunnelConfiguration.activationType == .activateManually) {
+            tunnelProviderManager.onDemandRules = []
+            tunnelProviderManager.isOnDemandEnabled = false
+        } else {
+            tunnelProviderManager.onDemandRules = onDemandRules(for: tunnelConfiguration.activationType)
+            tunnelProviderManager.isOnDemandEnabled = true
+        }
+
         tunnelProviderManager.saveToPreferences { [weak self] (error) in
             defer { self?.isModifyingTunnel = false }
             guard (error == nil) else {
@@ -213,6 +229,26 @@ class TunnelsManager {
             t.refreshConnectionStatus()
         }
     }
+
+    func onDemandRules(for activationType: ActivationType) -> [NEOnDemandRule] {
+        switch (activationType) {
+        case .activateManually: return []
+        case .useOnDemandOverWifiAndCellular:
+            return [NEOnDemandRuleConnect()]
+        case .useOnDemandOverWifiOnly:
+            let connectOnWifiRule = NEOnDemandRuleConnect()
+            connectOnWifiRule.interfaceTypeMatch = .wiFi
+            let disconnectOnCellularRule = NEOnDemandRuleDisconnect()
+            disconnectOnCellularRule.interfaceTypeMatch = .cellular
+            return [connectOnWifiRule, disconnectOnCellularRule]
+        case .useOnDemandOverCellularOnly:
+            let connectOnCellularRule = NEOnDemandRuleConnect()
+            connectOnCellularRule.interfaceTypeMatch = .cellular
+            let disconnectOnWifiRule = NEOnDemandRuleDisconnect()
+            disconnectOnWifiRule.interfaceTypeMatch = .wiFi
+            return [connectOnCellularRule, disconnectOnWifiRule]
+        }
+    }
 }
 
 class TunnelContainer: NSObject {