Key takeaways
- The Great Firewall detects and drops ordinary VPN protocols. What survives is traffic that looks like normal HTTPS: VLESS Reality and Hysteria2.
- Install and test everything before you fly. VPN apps are removed from Chinese app stores, and provider websites are blocked.
- Expect cat and mouse. The realistic goal is a provider that keeps working through crackdowns, not one that never blinks.
“Does my VPN work in China” is the question where most VPN marketing quietly falls apart. The Great Firewall is not a simple blocklist. It fingerprints VPN traffic with deep packet inspection and drops it, and it probes suspicious servers to confirm what they are. The result: apps from several big-name providers connect fine in London and simply spin forever in Shanghai.
Why ordinary VPNs fail there
| Protocol | What the firewall sees | Result in China |
|---|---|---|
| WireGuard | A recognisable WireGuard signature | Detected and dropped |
| OpenVPN | A recognisable TLS-inside-TLS pattern | Detected, often within minutes |
| IKEv2 | Standard IPsec traffic | Frequently throttled or blocked |
| VLESS Reality / Hysteria2 | Ordinary HTTPS / HTTP-3 traffic | Connects |
The protocols in the last row are the point. VLESS Reality borrows the TLS handshake of a real, well-known website, so there is nothing VPN-shaped to block without breaking the normal web. Hysteria2 rides QUIC, the transport behind HTTP/3, and blends in with modern web traffic. Our protocols guide has the full comparison.
The single most common mistake: arriving in China planning to "sort out a VPN there". App stores inside China don't carry VPN apps, provider websites are blocked, and payment pages often fail. Install the app, sign in, and test the stealth protocols before you fly.
What to look for in a China VPN
- Stealth protocols as standard. VLESS Reality or Hysteria2 on every plan, not paywalled behind a premium tier.
- Automatic protocol fallback. When one route is blocked, the app should try the next one itself instead of making you play network engineer at midnight.
- Servers near China. Hong Kong, Singapore, Japan and the US west coast give the best latency from the mainland.
- Support that answers. Crackdowns spike around sensitive dates. A provider that ships fixes and answers tickets during one is worth more than any spec sheet.
Our current top pick, VPNBaron, builds its apps around exactly this: VLESS Reality and Hysteria2 ship on every plan, and its Pathfinder feature does the protocol fallback automatically. Specialist rivals exist: Wannaflix runs the same protocol family through third-party clients at a higher monthly rate (compared here), and Astrill, the long-time expat standby, still works but charges $30/mo with no refunds (the alternatives to it). The mainstream brands mostly don’t survive here at all.
Streaming from inside China
The same setup covers the second thing travellers and expats actually want: the services they already pay for. Netflix, BBC iPlayer, Disney+ and YouTube are all unreachable from mainland China without a working tunnel. Once connected through a stealth protocol, pick a server in the country whose catalogue you want and open the app as usual. Our streaming guide covers the details and the honest expectations.
Is it legal?
For a foreign visitor using a VPN for ordinary browsing and streaming, enforcement in practice targets sellers of unlicensed VPN services, not individual travellers. That said, unapproved VPNs sit in a legal grey zone in China, rules can change, and this is not legal advice. Our VPN legality guide covers the wider picture, including the other countries that restrict VPN use (UAE, Iran, Russia and a handful more, where the same stealth-protocol logic applies).
Set up before you fly: the checklist
- Subscribe and install the apps on every device you’re taking.
- Sign in and confirm the account works.
- Connect once on each device using the stealth protocol, not just the default.
- Note the support email somewhere reachable without the VPN.
- Test on your first day, while your hotel Wi-Fi still feels cooperative.
Use the guarantee properly. A money-back window is your real-world China test. If the provider can't connect from your actual hotel and office, get the refund and switch. That is what the window is for.