KovraMost VPN recommendations for China are written by people who have not tested one there, and they fail for a single technical reason. The Great Firewall does not primarily maintain a list of VPN company IP addresses. It looks at how your connection begins and decides whether it looks like a VPN. Once you know that, the shortlist of what actually works becomes short and obvious.
Three layers you have to get past
DNS and IP filtering
The cheap layer: poisoned DNS responses for blocked domains, and null-routed addresses. Encrypted DNS handles the first, and a server outside the blocklist handles the second. This is the layer every "just use a VPN" article assumes is the whole problem.
Protocol fingerprinting
The decisive layer. Deep packet inspection reads the first packets of every connection and matches them against known protocol shapes. WireGuard's handshake initiation has a fixed message type and fixed field offsets. OpenVPN has a documented opcode structure. IKEv2/IPsec is unmistakable. All three are dropped on any port — moving OpenVPN to 443 does not help, because the inspection is on content, not port number. The mechanics are in the protocol comparison.
Active probing
The layer that kills obfuscation. When a connection looks unusual, the firewall's own infrastructure connects to that server and tests how it responds. A server that refuses to answer anything without a secret key answers unlike any normal service, which confirms the suspicion. This is why plain Shadowsocks — designed to look like random noise — has been steadily degraded since around 2019, as described in Shadowsocks versus VLESS Reality.
What survives, ranked
| Approach | Status in 2026 | Why |
|---|---|---|
| VLESS + Reality | Works | Presents a real site's TLS chain; probes hit that real site |
| VLESS/Trojan over TLS + CDN | Mostly works | Hides behind a large CDN's address space |
| Shadowsocks + v2ray-plugin | Patchy | TLS wrapper helps; your own domain is still a weak identity |
| Plain Shadowsocks | Unreliable | Entropy analysis plus active probing |
| WireGuard | Blocked | Fixed handshake layout, one packet to identify |
| OpenVPN, including TCP/443 | Blocked | Recognizable opcode structure |
| IKEv2 / L2TP / PPTP | Blocked | Distinctive and long since classified |
| International roaming SIM | Works | Traffic exits via the home carrier |
The preparation checklist
- Install and test before departure. App stores, provider websites and support channels are often unreachable inside the country.
- Save the subscription link offline — a note on the device, a screenshot, a copy on a second device. If your account email is a blocked provider, recovery becomes very hard.
- Carry more than one endpoint. Individual servers get blocklisted; a provider offering several regions gives you somewhere to fall back to.
- Prefer nearby regions — Japan, Singapore, Hong Kong, Korea — for latency, but keep a European or US endpoint as a backup, since routing quirks sometimes favour the distant one.
- Pay before you go, and preferably in a way that does not depend on a payment page loading later. Crypto subscriptions are convenient here for a mundane reason: they activate without a card 3-D Secure page that may not load. See paying with crypto.
- Verify there is no leak once connected, using the leak test guide.
Practical behaviour once you are there
- Expect worse conditions around politically sensitive dates. Filtering visibly tightens around major political meetings and anniversaries.
- Hotel and airport networks are often the most filtered. Mobile data frequently performs better than venue Wi-Fi.
- Turn off automatic connection on unknown networks if you would rather fail closed than hand a captive portal your traffic.
- Do not rely on free apps. They are the most heavily fingerprinted, the first to be blocked, and the least accountable — see are free VPNs safe.
What this means beyond China
The same architecture — fingerprinting plus active probing — is now deployed in Iran, Russia and Turkmenistan, and increasingly by corporate network vendors. A protocol chosen for censorship resistance today is also the one that keeps working on a hotel network with an aggressive filtering appliance. That is the practical argument for camouflaged transports even if you never leave home.
The short version
Nothing that announces itself as a VPN connects in China. What connects is traffic that is indistinguishable from an ordinary HTTPS session to an ordinary website, backed by a provider that maintains multiple endpoints and replaces them when they are blocked. Set it up before you fly, keep a backup, and test it while you still have an unfiltered connection.