Best VPN for China in 2026: what still gets through the Great Firewall

What actually happens to a VPN connection in China

The Great Firewall is not one wall. It is a collection of techniques applied at the international gateways run by the three state carriers, and the one that matters for VPN users is deep packet inspection. Every connection that leaves the country is examined for the signature of a VPN handshake. OpenVPN has one. WireGuard has one. IKEv2 has one. Once the system is confident, it does not usually block the connection — it throttles it to a trickle so the app still shows “connected” while nothing loads. That is the behaviour people describe as “my VPN works but it is useless”.

Obfuscation is the countermeasure: wrapping the tunnel so that, to an inspector, it looks like ordinary HTTPS traffic to a web server. ExpressVPN’s Lightway does this without a setting. NordVPN, Proton and Astrill do it with a mode you have to switch on. Providers without an obfuscated transport — CyberGhost, IPVanish, PrivadoVPN, Hotspot Shield — connect for a few minutes and are then squeezed.

Even the good ones have bad weeks. Filtering intensifies every March during the Two Sessions, around 4 June, during the October National Day holiday, and whenever something is happening that the government would rather people did not discuss. During those windows, expect to change servers several times a day.

Before you land: the checklist

1. Subscribe and install two providers while you are still outside the country. One primary, one backup. Both of the top two on this page have been our recommendation for that pairing.
2. Log in and connect once so the app has cached its server list and any obfuscation config.
3. Download the manual configs (OpenVPN profiles, or the provider’s mirror links) and keep them in a note. If the app’s server list update is blocked, manual configs still work.
4. Turn on the obfuscated mode before you fly: NordVPN → Settings → Advanced → Obfuscated servers; Proton → Protocol → Stealth; Astrill → StealthVPN.
5. Note the provider’s support email, because their website will be blocked and email is how they send mirror links.
6. Turn off automatic app updates on iOS. A failed update can remove a working version and leave you unable to reinstall.

Which server to connect to

Latency matters more in China than anywhere else because the firewall also introduces packet loss on international links. From Beijing and Shanghai, the reliable order is Hong Kong, then Japan (Tokyo or Osaka), then Singapore, then Taiwan and South Korea. US west-coast servers work but you will feel every one of the 150–200 ms. Avoid European exits unless you specifically need a European IP for a bank.

Phones versus laptops

iPhone users have it slightly easier: iOS’s built-in VPN framework is stable and the apps reconnect quickly after the frequent short drops. On the Chinese-region App Store the apps are not listed at all, so your Apple ID must be set to another country. Android users on a Chinese-market phone face a bigger problem — no Google Play, and pre-installed “security” apps that sometimes kill VPN processes. Sideloading the APK from the provider’s mirror is the workaround.

Laptops are fine with every provider here. If you use a work laptop with a corporate VPN, that will also be throttled; corporate IPsec tunnels are detected the same way, and many multinationals lease dedicated MPLS lines into China for exactly this reason.

What we have not tested yet

Every status on this page comes from user reports collected through 2026 and the providers’ own statements, weighed by how recent and how consistent they are. We have not yet run our own probes from inside the mainland. That is on the list: a China-based VPS running scheduled connection tests against each provider is the single most useful thing this page could add, and the reason the re-check date is printed at the top. Until then, treat “works” as “works for most people this month”, and keep the backup installed.