A VPN for China is a before-you-fly decision, not an on-arrival one.
Three things make it different from a VPN anywhere else. The law: China requires international connections to go through state-approved channels, and unapproved VPN services are filtered, though enforcement targets sellers far more than travelers. The technology: the national filter recognizes classic protocols such as OpenVPN and WireGuard by their traffic pattern, so they often never connect, while protocols that look like ordinary HTTPS hold up better. And the logistics: app stores and VPN websites are usually unreachable from Chinese networks, so whatever you haven't installed and tested at home, you won't get on the ground.
Nobody can promise a VPN will work from every Chinese network on every day. Filtering rules change, and they tighten around major events. What follows is the honest version: what you can control, and what you can't.
[1] install the app [2] configure two protocols [3] test: IP, WebRTC, IPv6 [4] save a key offline [5] keep roaming as a fallback └─ on the ground stores are unreachable
providers licensing, hosting rules travellers rarely named directly └─ enforcement aims at services far more than at individuals
Is a VPN legal in China? What the law says
China's rules on international networking require that connections abroad use the state's international gateways; using unapproved channels is a violation. In practice the attention goes to people who sell and distribute VPN services inside the country. Individual users have occasionally been fined, according to press reports over the years, but there's no pattern of enforcement against tourists, and nobody inspects phones at hotels or airports. The decision and the responsibility are yours; this isn't legal advice. A broader country list is in Is a VPN legal?.
One thing the filter never touches: roaming. If your data exits to the internet in your home country, which is what happens on international roaming and on most travel eSIMs, Chinese filtering doesn't apply and you don't need a VPN to reach your usual apps. How that works is explained in eSIM, roaming or a local SIM in China.
[ ] client installed at home [ ] keys saved as plain text [ ] connection tested at home [ ] offline maps and translator [ ] a second channel to reach people
Why VPNs don't connect in China
The national filter does a lot more than block addresses. It reads traffic and picks out protocols by their signature: packet sizes and their order in the handshake, telltale headers, how the connection behaves. OpenVPN and WireGuard have recognizable signatures, so the connection either never completes or drops after a few minutes, and the app just shows "connecting".
Protocols designed to be indistinguishable from an ordinary HTTPS session with a real website behave more reliably. VLESS with the Reality extension is the common example: to the filter, the tunnel looks like a TLS session with a legitimate domain, and there's no formal reason to interrupt it. How it works is in What is VLESS and Reality. This isn't invisibility and not a guarantee. It's a better bet than the classics, and it should be your primary option with a second protocol or server as backup.
recognisable packet shape └─ identified without being read well-known server addresses └─ they end up on lists a transport shaped like HTTPS └─ looks like any other site
Set up your VPN for China before you fly
Three practical reasons. VPN websites are usually unreachable from Chinese networks, so there's nowhere to download an app or a configuration file. The Chinese App Store carries no VPN apps, and changing your Apple ID region on the ground requires a payment method from another country. And testing is far easier where the internet is normal and you have time.
The minimum: app installed, signed in, two different protocols or two different servers configured, connection verified on the What Is My IP page, and the WebRTC and IPv6 leak tests clean. If the app can export its configuration, save a copy in your notes and in cloud storage.
What else affects the connection
The network. Mobile data and hotel Wi-Fi get filtered differently. If one won't connect for you, try the other.
The server. Locations close to China, like Hong Kong, Singapore and Japan, give you the lowest latency, but the filter can treat individual addresses very differently. Keep two or three in your pocket.
The date. Filtering tightens around national holidays and big events. If a connection that was working dies "for no reason", waiting it out and switching servers usually gets you back.
The kill switch. At home it protects you: when the tunnel drops, traffic doesn't fall back to the open network. In China the same behavior can look like "the internet is gone". If things stop working, check whether the kill switch is the cause, and enable it deliberately once the connection is stable. What it does is in What is a VPN kill switch.
time of day worse in the evening carrier they differ a lot hotel Wi-Fi usually the strictest province differences exist └─ "not working" is often "not working right now"
What a VPN in China doesn't do
It doesn't speed up hotel Wi-Fi. It doesn't help when the network refuses to establish a tunnel at all. It doesn't replace WeChat and Alipay: payments, taxis and deliveries in China run inside local apps, and those work without any VPN. And it doesn't make you anonymous: the carrier sees an encrypted connection, and websites still see your browser.
your logged-in accounts not hidden your phone number in SMS unchanged card payments abroad not solved local rules not waived
VPN not working after you land in China
- Switch your protocol, say from WireGuard to VLESS.
- Switch to a server in another country.
- Move between Wi-Fi and mobile data.
- Turn the kill switch off and check that your ordinary internet came back.
- Turn on roaming for a few minutes: enough to message home and download an updated configuration if your provider issued one.
If none of that works, it isn't necessarily your mistake; on some days very little connects. Roaming remains the one dependable fallback on those days.
If something won't load and you can't tell whether the problem is the network, the connection type or the tunnel, describe it.
Help me work out what is wrong with my
connection while traveling.
Where I am: (city, province in China).
Connection: (roaming / travel eSIM / local SIM /
hotel Wi-Fi).
What will not load: (list it).
What loads fine: (list it).
Tunnel: (on and connected / on but will not
connect / not using one).
Tell me which part is failing: the network
itself, the way I am connected, or the tunnel.
And what to check first.
If the data is not enough, ask instead of
guessing.All our China guides
This page is where you start. The rest of the series, in the order you'll probably need it:
- VPN apps from the App Store don't work in China. This did: nine months on the ground, and the key-in-a-client setup that held up when branded apps failed.
- Do you need a VPN with a travel eSIM in China?: not for your apps while the eSIM is the data line; the four cases where you still do.
- VPN for China on a laptop: Windows and Mac: the phone's trick doesn't carry over, and the one setting that catches everyone.
- Internet access in China for visitors: how to get online at all, from the airport onward.
- eSIM, roaming or a local SIM in China: which one you need a VPN with, and which one you don't.
- eSIM not working in China: the six settings to check before blaming the eSIM.
- Does Instagram work in China?: what is reachable, what isn't, and what travelers actually use.
- VPN for China on iPhone: the Apple ID region problem and the settings that matter.
- VPN not working in China? Fix it by symptom: the troubleshooting list for when you're already there.
- Internet in Sanya, Hainan for tourists: the island isn't an exception, whatever the resort says.
What's currently blocked there, from open sources with a date, is on the blocking map; how to read it alongside our outage measurements is in what's down right now: outages vs blocks.
404 VPN offers VLESS in its apps for Android and macOS (the platform list is on the download page), resolves DNS inside the tunnel, includes a kill switch on Android, and has locations in Hong Kong and Tokyo. Our WireGuard configs won't connect from China, so VLESS is the one to set up. The free plan, 2 GB a day on one device, is enough to run every check above before you fly. We don't promise availability from every network in China, and we recommend setting everything up at home. Details on the home page.
