🇨🇳 Great Firewall · Tested · Updated June 2026

Best VPN for China in 2026 — What Actually Works

China's Great Firewall (GFW) is the most sophisticated internet censorship system in the world. It uses deep packet inspection (DPI), IP blocking, DNS poisoning, and active probing to detect and kill VPN connections. Most VPNs that work fine in Europe and the US fail completely inside China. This page covers only what actually works in 2026 — tested by users on the ground in Beijing and Shanghai.

Technical background

What the Great Firewall Actually Does

Understanding the GFW's detection mechanisms explains why only obfuscated protocols survive it — and why standard OpenVPN or WireGuard connections fail within seconds of connecting from inside China.

Technique 1

Deep Packet Inspection (DPI)

The GFW reads packet headers and payload patterns to identify VPN protocols. OpenVPN, WireGuard, and IKEv2 all have distinctive byte sequences in their handshakes that DPI can match against signatures in milliseconds. Standard VPN traffic cannot hide from DPI without an obfuscation layer.

Technique 2

IP Blocking

Known VPN server IP addresses are blacklisted at the router level. VPN providers counter this by rotating IP addresses constantly. The GFW maintains an up-to-date list of known data centre IP ranges and blocks them wholesale — which is why smaller VPNs with limited server infrastructure fail almost immediately.

Technique 3

DNS Poisoning

DNS queries for VPN-related domains are intercepted and return incorrect IP addresses. Querying expressvpn.com or nordvpn.com from inside China returns a blocked or wrong IP. This is why you can't visit VPN websites to download software once you're in-country.

Technique 4

Active Probing

When the GFW suspects a connection might be a VPN, it sends its own probing packets to the suspected server and analyses the response. This is how it catches some obfuscated connections that fool passive DPI — the server's behaviour under probing reveals it as a VPN endpoint.

Technique 5

SNI Inspection

During the TLS handshake, the Server Name Indication (SNI) field reveals the destination hostname in plaintext. The GFW can read this to identify connections to VPN provider infrastructure, even when the payload is encrypted. Encrypted Client Hello (ECH) partially mitigates this, but GFW countermeasures continue to evolve.

The only solution: obfuscated protocols. Obfuscated VPN traffic is engineered to look like ordinary HTTPS traffic — the same protocol used for every website you visit. The GFW cannot block HTTPS without breaking the entire web, so well-implemented obfuscation can survive DPI. Not all obfuscation is equal: ExpressVPN's Lightway with obfuscation and Astrill's StealthVPN are the two implementations that consistently survive the GFW's active probing in 2026.

What actually works

Best VPNs for China in 2026

Our #1 pick for China

ExpressVPN

Longest track record. Automatic obfuscation. The default choice for travellers.

#1 China pick

Protocol

Lightway + obfuscation

Price/month

$6.67

Money-back

30 days

China reliability

High

ExpressVPN has the longest track record of any VPN in China. Its proprietary Lightway protocol is built on WireGuard's cryptographic architecture but with an obfuscation layer added on top. When the app detects a high-censorship environment, it automatically routes you through obfuscated servers — you don't need to manually toggle anything.

Most reliable over the past five years from user reports. The GFW does occasionally disrupt ExpressVPN connections — typically during politically sensitive periods like major Communist Party events or national anniversaries — but connectivity usually returns within hours. The 30-day money-back guarantee means that if it doesn't work for your trip, you can get a full refund.

Get ExpressVPN — $6.67/mo ›

30-day money-back guarantee. If it doesn't work in China, get a full refund.

Best for expats & long-term residents

Astrill VPN

Built specifically for China. The top choice among foreigners living in Beijing and Shanghai.

#2 China pick

Protocol

StealthVPN / OpenWeb

Price/month

$12.50

Money-back

7 days

China reliability

Very high

Astrill is the most popular VPN among foreigners living long-term in China. Unlike consumer-facing VPNs that treat China as one use case among many, Astrill's StealthVPN and OpenWeb protocols were specifically engineered for the GFW. StealthVPN wraps traffic in an obfuscated SSL layer; OpenWeb mimics standard HTTP and HTTPS browser traffic at the protocol level.

It's more expensive than ExpressVPN at $12.50/month, but expats who depend on VPN access for work — video calls, cloud services, accessing Google — consistently report Astrill as more stable over extended periods than any other provider. The higher price reflects genuine infrastructure investment in China-specific routing.

Visit Astrill VPN ›

Note: Astrill is not in our affiliate programme. This link is unsponsored.

Honourable mention

NordVPN

Obfuscated servers work inconsistently. Good as a backup. Not your primary China VPN.

HM backup

Protocol

Obfuscated OpenVPN

Price/month

$3.39

Money-back

30 days

China reliability

Inconsistent

NordVPN's obfuscated servers run OpenVPN with an obfuscation layer and can work in China — but results are inconsistent. User reports from 2025–2026 show NordVPN working well during quiet periods and failing more frequently during politically sensitive moments when the GFW's enforcement intensifies. At $3.39/month, it's worth installing as a backup alongside ExpressVPN. Do not rely on it as your only China VPN.

Get NordVPN — $3.39/mo ›

30-day money-back guarantee.

Skip these

What Doesn't Work in China

Every VPN below has been reported by users to fail inside China in 2025–2026 testing, for specific technical reasons.

Before you travel

Step by Step: Setting Up Before You Land

Follow every step below. Skipping any of them increases the chance you'll arrive with a VPN that either doesn't work or can't be fixed from inside China.

  1. Choose ExpressVPN or Astrill — ideally install both If your budget allows, install both. ExpressVPN is the more cost-effective single choice; Astrill is the better option if you're staying long-term or need maximum reliability for work. Having two VPNs means one works when the other has an outage.
  2. Download and install on every device you're bringing Laptop, phone, tablet — install and log in on all of them. VPN apps require an internet connection to first authenticate your account. Do this while you're outside China. If you forget a device, you won't be able to install remotely from inside the country.
  3. Connect and confirm it works before you leave Open the VPN app, connect to a server in a country you'd use from China (e.g. Japan, Singapore, or US), and verify that your traffic routes correctly. Visit whatismyip.com to confirm your IP has changed. This is your baseline test that the app and your account are working.
  4. Save customer support contact details offline Write down or screenshot the support email address and any alternative contact URLs (not the main website — those are blocked). ExpressVPN publishes a special URL for users inside China accessible via their installed app. Find it before you land and save it somewhere you can access without internet.
  5. Download manual config files as a backup ExpressVPN lets you download manual OpenVPN and Lightway configuration files from your account page. Download these to your devices before travel. If the app stops working, you may be able to connect using a manual config through the built-in VPN client on your device — bypassing the need for the app at all.
  6. On iPhone: check your App Store account region Chinese App Store accounts do not have VPN apps listed — Apple complies with Chinese regulations. If your primary Apple ID has a Chinese region set, you'll need to create or switch to a non-Chinese App Store account (US, UK, or any other supported region) to download VPN apps. Do this before you travel so you're not locked out.

Side-by-side

ExpressVPN vs Astrill vs NordVPN — China Comparison

Success rate based on aggregated user reports from Beijing and Shanghai, 2025–2026. Speed figures are estimated medians based on user-reported tests through servers in Japan and Singapore.

VPN Protocol for China Success rate Speed in China Price/mo Get it
ExpressVPN Lightway + obfuscation High 60–120 Mbps $6.67 Get deal
Astrill VPN StealthVPN / OpenWeb Very high 80–150 Mbps $12.50 Visit site
NordVPN Obfuscated OpenVPN Inconsistent 30–80 Mbps $3.39 Get deal

Prices shown are based on the longest available subscription term. All prices in USD. Updated June 2026. Astrill link is unsponsored — no affiliate relationship.

Legal context

Legal Note on VPN Use in China

Using a VPN in China is technically illegal for individuals under Chinese law. The Chinese government requires VPN providers to obtain government approval; unapproved VPNs are prohibited. In practice, enforcement against tourists and foreign visitors is extremely rare — there are no documented cases of a foreign national being prosecuted solely for using a VPN during a visit. Fines have occasionally been issued to Chinese citizens. Foreigners may receive a warning in rare circumstances. The legal risk for a short-term visitor using a reputable VPN for personal use is considered very low, but it is not zero. This page provides factual information. It is not a legal recommendation, and you should make your own assessment of the risk before travel.

Common questions

Frequently Asked Questions

Does ExpressVPN work in China in 2026?
Yes, based on user reports from Beijing and Shanghai in 2026. ExpressVPN's Lightway protocol with obfuscation is specifically designed to survive deep packet inspection. The app automatically detects when you're in a high-censorship environment and switches to obfuscated servers. It is not foolproof — the GFW occasionally disrupts connectivity during politically sensitive periods, such as major party events or national anniversaries — but it remains the most consistently reported VPN to work in China over the past five years. Always install and test it before entering China.
Is it safe to use a VPN in China?
Using a VPN in China is technically illegal under Chinese law, but enforcement against tourists and short-term foreign visitors is extremely rare. There are no documented cases of a foreign tourist being prosecuted for VPN use. Fines have occasionally been issued to Chinese citizens. The practical risk for most travellers is low, but this is a factual note, not a legal recommendation. Consult your own judgement and, if needed, legal advice for your specific situation.
Which VPN protocol works in China?
Standard protocols — OpenVPN UDP/TCP, WireGuard, and IKEv2 — are detected and blocked by the GFW through deep packet inspection. The packet signatures of these protocols are well-documented and trivially identified. Protocols that work are obfuscated variants that disguise VPN traffic as normal HTTPS. ExpressVPN's Lightway with obfuscation is the most widely reported to work reliably. Astrill's StealthVPN and OpenWeb protocols were built specifically for the GFW and are the most technically sophisticated implementations available. NordVPN's obfuscated servers run OpenVPN with an obfuscation layer and can also work, but less consistently than the other two.
Can I download a VPN inside China?
No, not easily. VPN apps are removed from the Chinese App Store. The official websites of most major VPN providers — including ExpressVPN.com and NordVPN.com — are blocked inside China. You must install your VPN before you arrive. If you're already inside China without a VPN installed, your options are very limited: a trusted contact outside China may be able to send you an installation file directly, or you could try accessing a provider's mirror URL via email (some providers send these to existing customers). The only reliable solution is to install before landing.
Does NordVPN work in China?
Sometimes. NordVPN's obfuscated servers can work in China, but results are inconsistent compared to ExpressVPN and Astrill. User reports from 2025–2026 indicate NordVPN works during periods of lighter GFW enforcement but becomes unreliable during politically sensitive times — major party congresses, national anniversaries, or periods of civil unrest. At $3.39/month it's a relatively low-cost addition to a China travel setup, but should be treated as a backup rather than a primary connection. Install it alongside ExpressVPN, not instead of it.