Choosing a VPN to use in China (or to use during travel to China) is meaningfully different from choosing a VPN for general use. China’s Great Firewall actively detects and blocks most VPN traffic. The VPNs that consistently work in China are the few that have invested in obfuscation technology to disguise their traffic as normal HTTPS, and that maintain server infrastructure specifically designed to handle Great Firewall countermeasures.
This guide is the practical answer for users who need a VPN that works in China, with the caveats that the situation changes frequently and no recommendation is permanent.
What “works in China” actually means
The Great Firewall does not block VPNs by detecting that you are using a VPN at the network layer. It does not need to. It blocks specific server IP ranges, blocks specific port and protocol combinations associated with VPN traffic, performs deep packet inspection to detect VPN-style encrypted traffic patterns, and increasingly uses machine learning models trained on detected VPN traffic.
A VPN that “works in China” is a VPN whose provider:
- Maintains “stealth servers” with rotating IP ranges that the Great Firewall has not yet blocked
- Implements obfuscation that disguises VPN traffic as plain HTTPS
- Uses ports and protocols that are not yet on the deep-packet-inspection block list
- Updates these defenses as the Great Firewall evolves
This is real engineering work. Few VPN providers actually do it. Many providers’ Chinese marketing claims they work in China; few actually do.
The four that consistently work
In our 2025-2026 testing window with travelers actively using these in China:
ExpressVPN with the “Lightway” protocol on stealth servers. ExpressVPN has invested heavily in China-specific infrastructure for a decade. Reliability has been highest among consumer VPNs.
Astrill, a smaller specialized provider that has focused on China-and-similar-markets since 2009. The product is more expensive than mainstream VPNs but has the strongest China track record.
VyprVPN with their Chameleon protocol, which is specifically designed to obfuscate VPN traffic.
NordVPN with obfuscated servers (a specific server type that adds traffic obfuscation on top of standard VPN). Reliability has improved meaningfully in the past two years; not as consistent as ExpressVPN but works most of the time.
VPNs that often do not work
Mullvad, ProtonVPN, IVPN. All excellent for general use; all do not invest in China-specific obfuscation. Connection succeeds intermittently but blocks frequently.
Surfshark. Despite shared parent with NordVPN, Surfshark’s obfuscation is less mature. Often blocked.
CyberGhost, Private Internet Access. Both Kape Technologies brands; obfuscation present but China-specific reliability is weaker than ExpressVPN.
Free VPNs. None work consistently in China. Most are blocked rapidly.
Setup considerations specific to China
Download the VPN app before you arrive. Many VPN providers’ websites are blocked from within China; you cannot download the software once there. Set up your account, install the app, configure obfuscated servers, and test it before traveling.
Have a backup. Even the best China VPNs occasionally fail. Carry the install files for two different providers, in case one is fully blocked during your trip.
Use only WireGuard or proprietary obfuscated protocols. Standard OpenVPN traffic is detected and blocked by the Great Firewall in most cases.
Be aware of the legal situation. The Chinese government regulates VPN use. Personal use by foreigners in major cities has historically not resulted in arrests, but the legal status remains ambiguous and the situation can change. Behave accordingly.
Use the VPN on every device. Smart TVs, smart speakers, IoT devices generally cannot run VPN clients themselves. Use a travel router (GL.iNet Beryl AX or similar) configured with your VPN to route all your devices through it.
Specific configurations
For ExpressVPN in China:
- Connect to one of the “Stealth” servers (Hong Kong 2, Hong Kong 3, Tokyo, Singapore are most reliable)
- Use Lightway protocol
- If Lightway fails, try OpenVPN UDP on alternative ports
- Enable the kill switch
For Astrill in China:
- Use the StealthVPN protocol (their proprietary obfuscation)
- Connect to Asia-region servers (less likely to be blocked)
- The OpenWeb feature is the standard browser-routing
- The Astrill VPN router setup is well-documented for whole-network routing
For NordVPN in China:
- Enable Obfuscated Servers in Settings
- Connect to obfuscated servers in Hong Kong, Japan, Taiwan
- Use OpenVPN TCP (TCP can blend with HTTPS more reliably than UDP under DPI)
Cost reality
ExpressVPN: $5-8/month on long plans. Higher than mainstream alternatives but justified by China reliability.
Astrill: significantly more expensive at around $15/month. Specialized service for users who need it to work without compromise.
NordVPN: $3-5/month on long plans. Cheapest of the China-capable options.
VyprVPN: $5-10/month depending on plan. Mid-priced.
For a one-time China trip of a few weeks: NordVPN’s monthly plan is the cost-effective choice.
For frequent or extended China travel/residency: ExpressVPN or Astrill annual plan justifies the price by reliability.
What to expect in practice
Even the best China VPNs occasionally fail. During major political events (party congresses, anniversaries of significant dates, major international events held in China) the Great Firewall increases scrutiny and previously-reliable VPNs may be temporarily blocked. Have backups.
Speed through the firewall is meaningfully slower than direct internet access in China. Expect 20-40% of your normal speed at best, sometimes much less.
Streaming services (Netflix, Hulu) generally work over VPN from China but with the same VPN-detection issues that streaming services have everywhere.
WhatsApp, Google services, and most Western apps require the VPN to function in China. They are blocked at the Chinese ISP level.
The cat-and-mouse with the Great Firewall is ongoing. A VPN that worked last month may not work this month. A VPN that has not worked may suddenly work. Stay flexible.
A specific recommendation
For travelers visiting China for less than a month: NordVPN monthly plan with obfuscated servers. Cost: about $13. Sufficient reliability for short trips.
For users in China for extended periods or frequent travelers: ExpressVPN annual plan. Cost: about $100/year. Higher reliability than NordVPN; the price difference is justified.
For users with maximum reliability needs and the budget for it: Astrill annual plan. Cost: about $150-180/year. The most reliable option.
For users on tight budgets visiting China briefly: NordVPN monthly is acceptable; do not expect 100% uptime.
For all options: download and configure before traveling. Test at home before relying on it.
A note on the broader picture
The Great Firewall situation evolves constantly. Information in this article is accurate as of mid-2026 testing. Before traveling to China, check current information from sources like RestorePrivacy, GreatFire (which monitors Chinese internet censorship in real time), and recent forum discussions in expat-focused communities.
What works today may not work tomorrow. Plan accordingly.
ExpressVPN | Astrill | NordVPN | VyprVPN
Related: Best VPN for travelers, ExpressVPN review