A VPN not working in China is the expected outcome for a classic setup, not a sign that you did something wrong.
The national filter recognizes OpenVPN and WireGuard by their traffic pattern, so those connections never complete or drop after a few minutes; the app sits on "connecting" and says nothing useful. Add two more common causes, an app that was never installed because the app store and the VPN website are unreachable from Chinese networks, and a holiday week when filtering tightens, and you have most cases. Below, each symptom is matched to its likely cause and the fix to try, in the order that costs the least time.
If you're still at home, the single most useful thing is in VPN for China: what to know before you land: install, configure two protocols, test, back up. If you're already in China, start with the symptom list.
stuck on connecting handshake spotted
drops after minutes protocol known
connected, nothing DNS
Wi-Fi ok, mobile no network differs
└─ fix the stage, not everythingSymptom: stuck on "connecting"
This is the one you'll hit most. Either your tunnel handshake is being spotted and dropped, or the server address simply can't be reached from this network.
- Wait a full minute. Your first connection from a new network is sometimes just slow to come up.
- Switch protocol. If you're on WireGuard or OpenVPN, switch to VLESS with Reality or another protocol that looks like ordinary HTTPS. If you're already on VLESS, try a different server.
- Switch to a server in another country. Hong Kong, Singapore and Japan are close by, but the filter can treat individual addresses very differently.
- Switch between Wi-Fi and mobile data. Hotel Wi-Fi and your local SIM are not filtered the same way.
If none of that helps, you may just be having a bad day out there. The last section covers it.
stuck on connecting clock, key connects then drops transport connected, nothing loads DNS Wi-Fi only or mobile only MTU, carrier cannot update the app the store
Symptom: connects, then drops after a few minutes
That's the classic signature of a protocol that got recognized: your connection is allowed to start, then killed. Switch to one that mimics HTTPS and stay there. If the drops continue on VLESS, change server; some addresses get flagged while others on the same provider don't.
off by under a minute usually fine off by a few minutes handshake fails off by hours server silent └─ fixed by turning on automatic time, not by reinstalling
Symptom: connected, but nothing loads
Three possibilities. The tunnel is up but DNS is failing: check on What Is My IP whether the address changed, and if it did, the problem is name resolution, which the app's "DNS inside the tunnel" setting usually fixes. Or the kill switch is on and the tunnel silently dropped: turn the kill switch off and see whether ordinary internet returns. Or the server is overloaded: change server. The general checklist for this state is in Why does my VPN keep disconnecting.
Symptom: works on Wi-Fi but not on mobile data, or the reverse
Normal. Carriers and hotel networks are filtered separately, and a protocol that passes on one may be dropped on the other. Use whichever works and don't spend time forcing the other. If mobile data is the one that works, your phone's hotspot can carry the laptop.
Symptom: can't install or update the app
VPN websites and the relevant app-store pages are unreachable from Chinese networks, and the Chinese App Store carries no VPN apps at all. Your options on the ground: switch on roaming for a few minutes, which exits to the internet in your home country and isn't filtered, and download from there; or ask someone at home to send you the configuration file. Next time, install at home. The iPhone specifics, including the Apple ID region, are in VPN for China on iPhone.
If the app itself is what keeps failing, the setup that sidesteps the problem is a plain key pasted into a generic client such as Happ; why that holds up when branded apps don't is in VPN apps from the App Store don't work in China. This did.
filtering is not static evenings are worse than mornings carriers differ from each other └─ "broken" and "busy right now" look identical from here
Symptom: it worked yesterday and not today
Filtering tightens around national holidays, major political events and sometimes for no visible reason, and a server or protocol that worked can stop for a day or two. Don't reconfigure everything; change server, try again in the evening, and use roaming in the meantime. Things usually return to normal without any action on your part.
open a site by raw IP address ├─ it loads → DNS is the problem └─ it fails → routing is ten seconds, and it halves the search
The order that saves the most time
- Protocol: VLESS with Reality. WireGuard and OpenVPN are blocked the same way the filter is blocking you now, so they are not a fallback here.
- Server: three options in nearby countries, tried in turn.
- Network: try Wi-Fi against mobile data.
- Kill switch off, then on again once stable.
- Roaming for a few minutes to message home and fetch an updated configuration.
- Try again later in the day. Seriously, that works more often than it should.
1 automatic time on 2 different server 3 different protocol 4 mobile data instead of Wi-Fi 5 wait an hour, load changes
Why roaming is the reliable fallback
On international roaming and on most travel eSIMs, your data leaves the Chinese tower and exits to the internet in your home carrier's country. The filter treats that as carrier transit and doesn't touch it, so Instagram, WhatsApp and Google work without any VPN. Keep the tunnel on over roaming and it adds a little to every megabyte you pay for: how much data a VPN uses. It costs more and adds latency, but on the days when no tunnel connects it's the one thing that does. The comparison with a local SIM is in eSIM, roaming or local SIM in China.
If something won't load and you can't tell whether the problem is the network, the connection type or the tunnel, describe it.
Help me work out what is wrong with my
connection while traveling.
Where I am: (city, province in China).
Connection: (roaming / travel eSIM / local SIM /
hotel Wi-Fi).
What will not load: (list it).
What loads fine: (list it).
Tunnel: (on and connected / on but will not
connect / not using one).
Tell me which part is failing: the network
itself, the way I am connected, or the tunnel.
And what to check first.
If the data is not enough, ask instead of
guessing.What no VPN can fix
A network that refuses every tunnel on a given day. A hotel Wi-Fi that needs a Chinese phone number to log in. Apps that were never installed. And the local side of your trip: payments, taxis and deliveries run in WeChat and Alipay regardless of any VPN, so if those are what you need, close the VPN app and use them directly.
404 VPN offers VLESS in its apps for Android and macOS (the platform list is on the download page), DNS inside the tunnel, a kill switch on Android, and locations in Hong Kong and Tokyo. Our WireGuard configs won't connect from China; use VLESS there. The free plan of 2 GB a day is enough to test the full checklist before you fly. We don't promise availability from every Chinese network on every day. Start on the home page.
