On demand has the effect of the VPN tunnel being started "on demand" based on a set of triggering criteria. Currently there are no criteria in place, so it always triggers. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>