Best VPN for China: Preparation, Backups, and Limits

No VPN can be described as permanently reliable in mainland China. Blocking methods, regional networks, mobile carriers, hotel Wi-Fi, and provider endpoints change. The safest plan is to install at least two reputable services before entering the country, sign in and update every app, save offline installation files and support instructions where permitted, and keep a non-VPN communication fallback.

Providers worth evaluating before travel include Astrill for its documented StealthVPN/OpenWeb modes and router option; Proton VPN for Stealth and alternative-routing features; NordVPN for obfuscated servers and NordWhisper on supported platforms; ExpressVPN for Lightway, broad apps, and detailed support; and Windscribe for Stealth and WStunnel. This is a capability shortlist, not a claim that every service currently connects from every Chinese network. Test before departure and ask each provider for its current China instructions.^[1]^[2]^[3]^[4]^[5]^[6]^[7]

Last verified: 2026-08-05

Important warning about changing availability

Connection status can change faster than an article can be updated. Provider websites, app stores, support chats, and authentication endpoints may be inaccessible after arrival. A service that connects on one carrier in Shanghai may fail on a hotel network in Beijing. iOS availability can also depend on the App Store region associated with the device.

Use this page to evaluate preparation and fallback quality. Do not treat it as a live uptime report. The broader VPN for travel guide covers public Wi-Fi, captive portals, device preparation, and travel-router trade-offs. Before travel, check the provider's current restricted-country support page and recent status information, then keep two independent options that use different protocols and infrastructure.

Current capability shortlist

Editorial basis: This edition compares currently documented capabilities, plan terms, platform support, and published policies. We did not run a new cross-provider speed or streaming test for this update unless a specific test is described below. Treat the shortlist as providers to evaluate for the stated use case, not a permanent performance ranking.

Provider	Relevant published modes	Platforms to verify	Key limitation
Astrill	StealthVPN, OpenWeb, router app	Windows, macOS, Linux, Android, iOS, compatible routers	Higher cost; refund policy is restrictive; current in-country reach must be confirmed^[7:1]
Proton VPN	Stealth	Windows, macOS, Linux, Android, iOS	Free and paid server choice differs; no guarantee in China^[1:1]
NordVPN	Obfuscated servers, NordWhisper	Windows, macOS, Linux, Android, iOS; some TV platforms	Modes cannot always be combined with specialty features^[4:1]^[5:1]
ExpressVPN	Lightway, automatic protocol selection, broad setup guides	Windows, macOS, Linux, Android, iOS, routers	Current connection instructions may be provided through support rather than a static public list^[6:1]
Windscribe	Stealth and WStunnel	Current desktop, mobile, Linux, TV, and router options should be confirmed before travel	Free data limit and free-location pool are poor substitutes for a paid travel setup^[2:1]^[3:1]

A privacy-focused service such as Mullvad can still be part of a backup plan because it publishes WireGuard bridges, Shadowsocks-related guidance, and DAITA features, but availability must be checked just as carefully. The relevant question is not “Which brand is best?” but “Which two independent connection methods can I install and verify before entry?”^[8]

No row in this shortlist asserts live availability throughout China. Network filtering varies by region, carrier, hotel, and time. Install and test before travel, keep offline installers or configuration material where permitted, and maintain a separately installed backup.

Why ordinary VPN connections are blocked

Network filtering can identify or disrupt VPNs through several layers:

blocking known VPN server IP addresses;
detecting recognizable protocol handshakes or packet patterns;
interfering with DNS resolution or provider domains;
resetting connections to suspicious endpoints;
throttling encrypted flows or specific ports;
preventing app downloads, updates, or account authentication;
applying different controls by carrier, province, or network type.

Obfuscation attempts to make VPN traffic less distinguishable from ordinary encrypted traffic. It can improve reachability, but it also adds complexity and may reduce speed. A protocol designed for restrictive networks is not a guarantee against active probing or future rule changes.

What to prepare before the trip

Buy and install two services. Choose providers with different protocols and ownership, not two plans from the same network.
Update every app. Old clients may lack current connection methods or certificates.
Sign in and save recovery codes. Do not assume email, app-store, or password-manager access will be available immediately.
Download offline installers. Keep legitimate copies for Windows, macOS, Android, and Linux as needed. iOS installation is constrained by App Store rules, so install before departure.
Generate manual configurations. Save WireGuard/OpenVPN files only when the provider recommends them for the destination; ordinary configs may be blocked.
Record support channels. Keep email addresses and troubleshooting pages in an offline note.
Test on mobile data and Wi-Fi. A service that works only on your home ISP has not been travel-tested.
Keep a fallback communication plan. A roaming SIM, employer-approved connection, or international mobile service may be more dependable for urgent contact.
Review local rules and employer policies. Regulations and enforcement can change. Organizations may require approved corporate tools rather than a consumer VPN.

Primary and backup VPN strategy

The primary service should have the most suitable documented app and protocol support for your main device. The backup should be operationally independent: different provider, different login, and ideally a different obfuscation method. Do not wait for the primary service to fail before opening and updating the backup.

Create a one-page offline runbook:

primary app and preferred restricted-network mode;
two provider-recommended server regions;
backup app and protocol;
support contact;
where the installers and recovery codes are stored;
how to disable battery optimization or enable always-on VPN;
the date each app was last tested.

Avoid changing many settings at once. If a connection fails, test one variable—network, server, protocol, or device—so you know what resolved it.

Provider notes

Astrill

Astrill publishes StealthVPN and OpenWeb modes and offers a router application for supported hardware. It is frequently considered for restrictive networks because those modes are central to the product rather than hidden in manual settings.^[7:2]

Best for: users willing to pay for a service focused on difficult networks and router use.

Limitations: review its current refund and trial policy carefully; do not assume a standard 30-day guarantee. Ask support which modes and platforms are currently recommended before purchase.

Pre-purchase check: obtain a written answer about current China setup and whether the account can be activated before entry.

Proton VPN

Proton's Stealth protocol is intended to disguise VPN traffic, and the apps use alternative routing to reach Proton infrastructure when direct access is blocked. Proton supports major desktop and mobile platforms, including Linux.^[1:2]

Best for: users who want a privacy-focused provider with modern restricted-network features.

Limitations: free accounts have constrained server selection and should not be the sole travel plan. Feature availability differs by platform.

Pre-purchase check: confirm Stealth support on every device and save current restricted-network instructions offline.

NordVPN

NordVPN provides obfuscated servers and NordWhisper. Obfuscated servers require compatible protocols and platforms; NordWhisper is designed for restrictive local networks but cannot be combined with every specialty feature.^[4:2]^[5:2]

Best for: travelers who want a broad mainstream app set and several fallback modes.

Limitations: the mode that works on an airport or office network may not be the mode recommended for China. Do not configure it from memory; follow current support guidance.

Pre-purchase check: verify the exact app version and mode available on iOS, Android, macOS, Windows, and Linux.

ExpressVPN

ExpressVPN offers Lightway and automatic protocol selection across a broad range of apps, plus a distinct router platform. Its support operation is useful when public instructions must change quickly.^[6:2]

Best for: travelers who value guided support and router coverage.

Limitations: plan pricing and connection allowance vary by current offer. No static page can establish present reachability from China.

Pre-purchase check: contact support shortly before travel and save the response and setup links offline.

Windscribe

Windscribe documents Stealth and WStunnel for restricted networks. Its current download page lists desktop, mobile, Linux, TV, and router options; confirm the exact build and protocol availability on every device before travel.^[2:2]^[3:2]

Best for: technically comfortable users who want several protocol options and a secondary provider.

Limitations: the free plan's data and location constraints make it unsuitable as the only long-term connection. Some protocols are unavailable on certain mobile platforms.

Pre-purchase check: confirm the current recommended protocol for each operating system, not only the desktop app.

Mobile devices, laptops, and routers

iPhone and iPad

Install the app before entry and verify that it remains in the App Store region tied to your account. Keep iOS updated, but avoid a major upgrade immediately before travel unless the VPN provider confirms compatibility. Enable on-demand or always-on behavior only after testing that it does not block captive portals.

Android

Save the official APK from the provider when the provider publishes one and local rules permit it. Disable battery optimization for the VPN app if the operating system suspends background connections. Keep the package signature and download source verifiable.

Windows, macOS, and Linux

Keep full installers and checksums where available. Linux users should confirm whether restricted-network modes exist in the GUI, CLI, or only a manual configuration. Test DNS and IPv6 behavior after each protocol change.

Travel routers

A router can cover several devices and keep the VPN configuration outside a TV or console, but it is not always the first connection to bring up on a captive-portal network. Complete the portal on a direct device or use the router's documented portal workflow, then enable the tunnel. GL.iNet and other OpenWrt-based travel routers can run WireGuard/OpenVPN clients, but a normal protocol may still be blocked. See the VPN router guide for hardware and policy-routing checks.

Diagnosing a failed connection in China

Follow this order:

Confirm ordinary internet access without the VPN.
Test a different network: mobile data versus Wi-Fi.
Check whether the account is active and the device time is correct.
Use the provider's current recommended restricted-network mode.
Change to one provider-recommended server, not a random sequence of countries.
Disable another VPN, proxy, or security app that may own the network interface.
Restart the app and device.
Test the backup provider.
Contact support with app version, network type, city, protocol, and error—not browsing details.

For general tunnel failures, use VPN won't connect. If the tunnel connects but one site fails, use VPN not working or the site-blocking guide rather than repeatedly reinstalling the app.

When the provider is not suitable

Switch or add a backup when the provider lacks a supported obfuscation mode on your device, cannot authenticate without access to a blocked website, provides no current restricted-country guidance, or fails across several independent networks for more than a short outage. Also switch if support only repeats generic “change server” advice without identifying a current connection method.

Do not make a multi-year commitment based solely on one successful pre-trip test. A monthly or refundable plan can be rational when the destination is highly variable.

FAQ

Which VPN definitely works in China?

None can be guaranteed. Availability changes by network, region, protocol, and time. Prepare at least two independent services before entry.

Should I download the VPN after arriving?

No. Install, update, authenticate, and test before travel. Provider sites and app stores may be inaccessible or may not list the app in the local store region.

Is obfuscation the same as a different server?

No. A server changes the endpoint; obfuscation changes how the traffic appears on the network. Both may be required, and the provider may recommend specific combinations.

Is a free VPN enough for China?

It is a poor primary plan. Free tiers limit locations, server control, data, or support. Use a paid or otherwise fully supported plan with current restricted-network guidance and a backup.

Should I use a travel router?

A travel router is useful for several devices, but it adds a captive-portal and hardware layer. First make sure the provider supports manual configurations and that you can troubleshoot the router offline.

What if the VPN connects but websites do not load?

Check DNS, system time, IPv6 behavior, and whether the selected mode supports normal internet access. Then try a provider-recommended server. Do not assume every failure is censorship; the hotel or mobile network may also be unstable.

Is consumer VPN use legal in China?

Rules and enforcement can change and can depend on the user and purpose. Review current official travel advice, local law, and employer requirements before relying on a consumer VPN. This page is technical preparation, not legal advice.