Your laptop needs its own plan for China, because the trick keeping your phone online doesn't carry over.
That travel eSIM lives in the phone. Your laptop on hotel Wi-Fi is sitting on Chinese internet, and every app on it that talks to a server abroad will hang. The fix is the same one that works on a phone, a plain connection key pasted into a client that isn't tied to any provider, but on a desktop there's one setting that decides whether the VPN covers the whole system or only the browser, and it catches almost everyone the first time.
Below: why the phone's setup doesn't transfer, which clients accept a plain key on Windows and macOS, the system-wide versus browser-only question, the test to run at home, and what hotel networks do on the ground.
system proxy browser works
mail and chat hang
TUN mode everything goes through
└─ this is the one you wantWhy your laptop needs its own setup for China
On a phone, most travelers rely on a travel eSIM: data exits abroad, filtering never applies. The laptop has no eSIM. It joins hotel or office Wi-Fi, which is an ordinary Chinese connection, and it's filtered like any local line. You can share the phone's eSIM as a hotspot, and it works, but everything the laptop does then comes out of the eSIM's data, and a working day of video calls and cloud sync empties a travel plan quickly. Most people who work on the trip end up with both: the hotspot as a fallback, a VPN on the laptop for the day. How the eSIM side behaves is in Do you need a VPN with a travel eSIM in China.
phone client one tap, own store laptop client installed by hand phone protocol often app-specific laptop protocol you choose it └─ the key may carry over, the app almost never does
Choose a client that takes a plain key
Branded VPN apps fail in China for the same reasons on a laptop as on a phone: recognizable protocols and dependence on the provider's servers for updates and configuration. What holds up is a generic client into which you paste a vless:// key or a subscription link, so that nothing about the connection is tied to an app store or a brand. Why that difference matters is the story of VPN apps from the App Store don't work in China.
- Windows: Hiddify or v2rayN. Both take a key or a subscription link, and both can run system-wide.
- macOS: Hiddify or V2Box. Same deal.
- Install two if you can. They're small, and a second client is the cheapest insurance against one of them misbehaving on an unfamiliar network.
Download from each project's official page while you're still at home. Small open-source clients are often unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch; that is expected for these projects, and the right response is to make sure you downloaded from the official page, not to look for a different client on the ground, where the pages won't open.
System-wide or browser-only: the setting that matters
Desktop clients give you two modes, and the one they default to is usually the wrong one for travel.
System proxy mode tells your operating system "send web traffic through me". Your browser listens. Plenty of other programs don't: mail clients, chat apps, terminal tools, sync clients and some video-call apps talk to the network directly and ignore the proxy. The result is a browser that works and a Slack or a mail app that sits on "connecting", with the VPN showing green the whole time.
TUN mode, sometimes labeled VPN mode or system tunnel, creates a virtual network interface and routes everything through it, the way a phone's VPN does. This is the mode you want in China. It usually asks for administrator rights on first use, and on macOS it may ask to install a system extension; do both at home, not in the hotel.
While you're in that screen, set DNS to resolve inside the tunnel, or enable the client's equivalent option. Without it the laptop asks the hotel's DNS where things are, and half of what you open will fail even with the tunnel up.
system-wide everything goes through
the tunnel
browser-only only the browser does
└─ mail clients and updaters stay
outside, and they are exactly
what breaks firstImport the key and test at home
- Copy your key or subscription link from your provider. With 404 VPN it's the key in your dashboard; a subscription link is better than a single key because it refreshes the list of keys on its own.
- Paste it into the client: "Add from clipboard" or "Import subscription", depending on the app.
- Flip the client into TUN mode and connect.
- Open What Is My IP and confirm the address and country changed. Run the WebRTC leak test and the IPv6 leak test; a laptop on a network with IPv6 can send part of its traffic around a tunnel that only carries IPv4.
- Open the apps you'll actually work in, not just the browser, and confirm they connect with the tunnel up.
- Export the configuration, or copy the key into your notes, so that a reinstall on the road doesn't depend on reaching a website.
[ ] key imported, tunnel comes up [ ] address changed to the server [ ] DNS resolves inside the tunnel [ ] survives sleep and wake [ ] survives a network change
Hotel Wi-Fi in China on a laptop
Hotel Wi-Fi in China often starts with a captive portal that asks for a room number or a Chinese phone number. Until you're through it, nothing connects, VPN included; connect first, then start the tunnel. Some hotel networks are filtered more aggressively than mobile data, and a key that works on the phone's local SIM may fail on the same hotel's Wi-Fi. When that happens, the phone's hotspot is the quickest path: it moves the laptop onto the phone's line, eSIM or local SIM, and the VPN behaves as it does on the phone.
Keep the kill switch in mind. At home it protects you: when the tunnel drops, traffic doesn't fall back to the open network. In China the same behavior looks like "the internet is gone". If everything stops at once, check whether the tunnel dropped and the kill switch is holding the line, before blaming the hotel.
it may already carry a managed tunnel two tunnels fight over the default route installing clients may be blocked └─ ask IT before the trip, not during it
Using a work VPN in China
A corporate VPN inside a personal tunnel sometimes works and sometimes doesn't, and whether it's allowed is a question for your IT department, not for a travel guide. Test the combination at home: connect the personal tunnel first, then the corporate one, and see whether mail and internal tools open. If they don't, ask IT before you fly; from the hotel there will be nobody to ask.
hotel Wi-Fi strictest, often
blocks whole protocols
phone hotspot usually more forgiving
café Wi-Fi varies wildly
└─ try the hotspot before
concluding the key is deadIf you're not sure which connection type suits your trip, describe it and get an answer for your case.
Help me choose how to get online in China.
Trip length: (how many days).
Cities: (which).
Phone: (model; supports eSIM: yes / no).
What I need: (maps and messaging / social apps /
video calls / working from a laptop).
Do I need a local number for payments and taxis:
(yes / no / not sure).
Compare roaming, a travel eSIM and a local SIM
for my case and tell me which to take.
For each one, say where my traffic will leave
the country.
Do not invent prices: if you do not know, say so.VPN not connecting on your laptop in China
Switch your key. Switch your client. Move off hotel Wi-Fi onto your phone's hotspot. Turn the kill switch off and check that ordinary internet comes back. And on a genuinely bad day, roaming on the phone for a few minutes remains the one dependable way to message home. The symptom-by-symptom version is in VPN not working in China? Fix it by symptom.
404 VPN gives you a vless:// key or a subscription link in your dashboard that works in Hiddify and v2rayN on Windows and in Hiddify and V2Box on macOS, alongside our own Android app for the phone. The free plan is enough to run the whole test above before you fly. We don't promise availability from every network in China on every day; we do recommend setting up at home, in TUN mode, with a second key saved. Start on the home page.
