VPN for China: How the Great Firewall Blocks Them, and What Actually Survives

How the Great Firewall detects a VPN

The Great Firewall does not maintain a list of VPN websites and block those. Blocking a domain is trivial and easily worked around; the system instead identifies the traffic itself, which is why a provider can be reachable one day and useless the next without anything changing on your device.

Two techniques do most of the work. The first is deep packet inspection. Standard VPN protocols have recognisable handshakes: an OpenVPN session opens with a distinctive pattern, and WireGuard has a fixed initiation message with a known structure and length. Neither was designed to hide that it exists - they were designed to keep the contents secret, which is a different problem. A middlebox watching the first few packets of a connection can classify it without decrypting anything.

The second is active probing. When a connection looks suspicious, the system can connect to the same destination itself and speak the protocol it thinks is there. If the server on the other end answers like a VPN server, the address gets added to a blocklist. This is why self-hosting a VPN on a cheap cloud server often works briefly and then stops: the endpoint is discovered, not deduced.

Obfuscation is the answer to both. A stealth or obfuscated transport wraps the tunnel so the handshake resembles ordinary HTTPS traffic on port 443, and a well-implemented one will not answer a probe in a way that identifies it. That is the whole of the feature: it does not make the VPN faster or more private, it makes it harder to classify.

The three networks your traffic actually crosses

Almost all consumer traffic in mainland China rides one of three carrier networks, and filtering is applied at that level rather than by your building or city. Knowing which one you are on tells you more than a speed test does, because reports of what is working are often carrier-specific.

• China Telecom - the largest fixed-line operator, and the network most international routes transit.
• China Unicom - historically the friendlier of the three for international routing, which is why it appears often in traveller reports.
• China Mobile - dominant on mobile data, and the one most visitors meet first through a prepaid SIM.

Check which network you are actually on with our ASN lookup - it returns the autonomous system carrying your connection, which is the level filtering is applied at. If you are comparing notes with someone else about what works, comparing ASNs is far more useful than comparing cities.

Set it up before you arrive, not after

This is the mistake that strands people. The app stores that distribute VPN clients are themselves restricted inside China, and provider websites are frequently unreachable. Arriving without a VPN already installed and configured means you may have no straightforward way to get one.

1. Install the app on every device you are taking, and sign in while you are still on a normal connection.
2. Turn on the obfuscation or stealth setting explicitly. It is usually off by default, because it costs speed and most users do not need it.
3. Note the provider's support contact and any manual configuration files somewhere offline. If the app cannot update its server list, manual config may be the fallback.
4. Buy within a refund window and keep the receipt. If the provider turns out to be unreachable, the refund is your insurance - this is the single most useful precaution on this page.
5. Verify the tunnel behaves before you depend on it, using the VPN working flow, DNS leak test and WebRTC leak test.

Take more than one provider if the trip matters. Two subscriptions inside their refund windows costs very little and removes the single point of failure, which is a better use of money than trying to identify the one correct provider in advance.

The legal position, stated carefully

China does not operate a blanket criminal ban on individuals using VPNs. What exists is a licensing regime: providing cross-border VPN services commercially requires state approval, which is why unapproved international providers are blocked rather than prosecuted. Enforcement in practice has focused on people selling or distributing access, not on foreign visitors reading their own email.

That said, this is a jurisdiction where written rules and enforcement practice are not the same thing, and both can change. If you are travelling for work, follow your employer's guidance rather than a web page. Our guide to VPN legality covers how these regimes differ country by country.