visibility vs disguise
VPN for China
China's firewall is not a blocklist. It's an active detection system — one that identifies VPN traffic by what it looks like, not just where it's going. Standard VPN protocols don't work there. The question isn't which provider is fastest or cheapest. It's which ones have built their infrastructure around surviving active DPI.
What's your situation?
This fits you if
- You're travelling to China and need your normal apps to work
- You need consistent access, not just occasional connectivity
- You're travelling during a politically sensitive period
What's happening
The Great Firewall is the most sophisticated internet filtering system in operation. It doesn't block VPNs by recognising their IP addresses — though it does that too. It uses deep packet inspection to identify the characteristic traffic patterns of VPN protocols: the handshake structure of OpenVPN, the timing signatures of WireGuard, the header patterns of standard TLS tunnels. When it recognises the pattern, it terminates the connection. No warning. Just a drop.
Obfuscation is the only meaningful response. Traffic that looks like VPN traffic gets blocked; traffic that looks like ordinary HTTPS browsing passes. The VPN protocols that work inside China are the ones designed from the ground up to disguise their fingerprint — not standard protocols with an 'obfuscation checkbox' bolted on. The difference is detectable under sustained analysis. China's filtering infrastructure is capable of that analysis.
The GFW also has a learning component. IP addresses that route large volumes of suspiciously-shaped traffic get added to block lists. This means that during politically sensitive periods — anniversaries, major events, legislative sessions — the filtering intensifies and providers that had been working may stop working temporarily. Reliability in China is not a binary state. It's a probability that shifts with external conditions you don't control.
Philosophies
Complexity should be invisible
Express has one of the longer operational histories in China specifically — years of iterating obfuscation against an adversary that iterates back. The Lightway protocol with obfuscation handles protocol selection automatically, which matters in China because the right choice changes based on network conditions you can't see. The trade-off is the same as everywhere with Express: automatic means you're trusting the system's decisions. When the system makes the wrong call in China, you can't override it manually in the way you can with Proton. The Kape Technologies ownership is part of the context regardless of the operational record.
Visit ExpressVPNVerification over convenience
Stealth is Proton's obfuscation protocol, designed to make VPN traffic indistinguishable from HTTPS at the packet level. It has a meaningful operational record in high-restriction environments including China. Where Proton differs from Express is in transparency: the Stealth implementation is documented, the open-source client can be inspected, and the configuration is accessible rather than hidden. Users who want to understand what their obfuscation is doing — not just trust that it's working — have more to work with here. The downside is that if Stealth doesn't connect, the troubleshooting is on you.
Visit ProtonVPNScale done reliably
Nord's Obfuscated Servers work for a wide range of restricted environments and for many users in China much of the time. The infrastructure scale means multiple obfuscated exit points to rotate between if one gets blocked. What Nord doesn't offer is protocol-level obfuscation depth — the obfuscation sits above the protocol rather than redesigning the traffic fingerprint from scratch. In routine conditions this is sufficient. During periods of intensified filtering, the gap between surface obfuscation and deeper disguise becomes real.
Visit NordVPNIdentity should not be required
Mullvad's Shadowsocks and bridge support give it a technically sound obfuscation layer. The no-account architecture means that even if your traffic pattern is observed, there's no account identity to associate with it. The constraint for China specifically is server coverage: Mullvad's network is smaller and more geographically concentrated than the large commercial providers. If the exit nodes closest to Hong Kong or nearby regions get blocked during a filtering surge, your options narrow quickly.
Visit MullvadRecognize yourself
You're travelling to China and need your normal apps to work
Set up and test before you arrive. The GFW blocks VPN providers' own websites and app stores — downloading or configuring a VPN after landing is difficult and sometimes impossible. The VPN app needs to be installed, the obfuscation mode needs to be enabled, and at least one working server connection confirmed, while you're still on an unrestricted network.
You need consistent access, not just occasional connectivity
Some providers work in China intermittently — connecting on some days, failing on others, failing entirely during sensitive periods. For occasional travellers who can tolerate interruption, intermittent is acceptable. For people working or living in China who depend on reliable access to foreign services, a provider with an operational track record in China specifically — not just general obfuscation credentials — is a different requirement.
You're travelling during a politically sensitive period
The GFW intensifies around major anniversaries, national events, and legislative sessions. Providers that work reliably in ordinary conditions can become unreliable or fully blocked during these windows. The ones with the deepest obfuscation implementations, the largest IP rotation pools, and the longest operational history in China are the most likely to maintain some connectivity when the filtering ramps up. No provider guarantees it.
You want to use a VPN but you're uncertain about the legal dimension
VPN use by foreign nationals in China exists in a legal grey area. Enforcement against tourists is rare. The legal restrictions are primarily directed at providers and at Chinese citizens using unauthorised VPNs, not at visitors using commercial services for ordinary browsing. The practical risk profile for a foreign traveller is different from the legal text — but only you can assess how much that distinction matters for your situation.
No guarantees
No VPN provider guarantees consistent connectivity in China. The GFW is actively maintained and adapts to circumvention techniques. A provider that works today may be partially or fully blocked by the time you arrive. Reliability in China is probabilistic, not certain — and the probability shifts with conditions outside anyone's control.
Speed through obfuscated connections in China is lower than standard VPN speeds. The obfuscation layer adds overhead, the routing adds latency, and congestion on the available exit nodes fluctuates. Video calls, streaming, and large file transfers will perform differently than at home — some will work acceptably, others won't.
The VPN encrypts your traffic and changes your apparent location. It does not change the physical environment you're in or the legal framework that applies to you there. What is technically achievable and what is legally appropriate in your specific situation are separate questions.
Related guides
© 2026 Softplorer