title: NetworkExtension connectOnDemand rules doesn't work
body: <p>I have an app with VPN config created by the new NetworkExtension framework. It works just fine, but now I need to add some rules to turn this VPN only when I'm trying to connect to a specific URL. I planed to use NEVPNManager's connectOnDemand feature, but it does`t seem to be working for me. When I'm opening <a href="http://some-site.com" rel="nofollow">http://some-site.com</a> in safari my VPN connection should establish, but for some reason it does't. I tried a different type of configurations as well as using generated .mobileconfig files to make connectOnDemand work, but with no luck. Whats wrong with it?
  I'm testing on code like this:</p>
  
  <pre><code>let manager = NEVPNManager.sharedManager()
  
  manager.enabled = true
  
  manager.loadFromPreferencesWithCompletionHandler { (err) -&gt; Void in
      manager.removeFromPreferencesWithCompletionHandler { (err0) -&gt; Void in
                  print("err0 \(err0)")
                  print("err \(err)")
                  let config = NEVPNProtocolIPSec()
                  config.localIdentifier = "NEVPNProtocolIPSec"
                  config.remoteIdentifier = "NEVPNProtocolIPSecRemote"
                  config.disconnectOnSleep = true
                  config.serverAddress = server
                  config.authenticationMethod = .Certificate
                  //configurating here
                  manager.protocolConfiguration = config
                  let onDemandRule1 = NEOnDemandRuleConnect()
                  onDemandRule1.DNSSearchDomainMatch = ["some-site.com", "*.some-site.com"]
  
                  manager.onDemandRules = [onDemandRule1]
                  manager.onDemandEnabled = true
                  manager.saveToPreferencesWithCompletionHandler({ (err2) -&gt; Void in
                      print("err2 \(err2)")
                  })
              }
          }
  </code></pre>