How can I automatically re-connect to a WiFi network?

Your issue is caused by Captive Portal¹ Check kicking in and not permitted through by AFWall+. So if you can live without that auto-detection, you could simply disable it:

# check what the original setting is. Should give "1" for enabled, "0" for disabled

settings get global captive_portal_detection_enabled

# now let's disable it

settings put global captive_portal_detection_enabled 0

# if you want to re-activate it

settings put global captive_portal_detection_enabled 1

Implications:

• no more pop-ups when connecting to e.g. a hotel network using Captive Portal. Easy work-around: just open a web browser and navigate to any url, the portal should "capture" you for login


• no more x on the WiFi symbol – so you might miss the fact of not reaching any network until you try manually (e.g. by visiting some web page and ending up on the Captive Portal's login page)


• automatic re-connect to "known WiFis" should simply work.

I've used that trick myself when having set up AFWall+ in a quite restricting mode, and it worked for me. As you (OP) just confirmed in a comment on the question, it did the trick for you as well – despite the additional complication of a VPN.

See Captive Portal parameters for more details on manipulation.

¹ _{for those who don't know what a "Captive Portal" is, please see Wikipedia}