Do VPNs work in China?

Three layers. First, IP blocking: known VPN-provider IPs are added to a firewall denylist. Second, deep packet inspection: even on unknown IPs, VPN protocols have recognisable handshake patterns. Third, active probing: when traffic looks suspicious, the firewall sends test packets to the destination to confirm whether it's a VPN endpoint.

All three together mean a vanilla OpenVPN or WireGuard connection rarely survives more than minutes from inside China.

Obfuscation modes wrap the VPN protocol in something that looks like ordinary HTTPS, often using shadowsocks, V2Ray, or proprietary mechanisms. The DPI scanner sees what looks like a TLS connection to a normal-looking destination.

ExpressVPN's 'Lightway' obfuscation, NordVPN's 'NordWhisper', and Astrill's 'StealthVPN' are the modes that have proven most resilient over 2024–2026. The mode you need is rarely the default — you typically have to enable it explicitly in the client settings.

Download the VPN client and any obfuscation modes before you arrive — provider websites and app-store listings are themselves blocked from inside the firewall, so you can't fix this once you're there.

Test the obfuscation mode at home so you know it works. On arrival, expect occasional outages: when one obfuscation server gets fingerprinted, providers rotate, and there's a few hours of downtime per month.