Best VPN for Traveling to China in 2026

What's blocked in China right now — independently tested

Almost every China guide asks you to trust its block list. You don't have to trust ours: the table below is compiled from GreatFire.org, a censorship monitor that has been running automated reachability tests from inside mainland China since 2011 and publishes the raw results per domain. Every row shows the date that domain was last tested, so you can see how fresh the evidence actually is — and check any of it yourself.

Two practical consequences. First, the block list covers the app stores as well as the apps: if a messaging app is not already on your phone when you land, downloading it in China is its own problem — which is why the set-up-before-you-fly rule matters more here than anywhere else. Second, blocking is not uniform. Results differ between Beijing, Shanghai and Shenzhen, between fixed-line and mobile networks, and between hours of the same day, which is exactly why a single anecdote ("it worked fine for my colleague last month") is worth very little. For the calling side of this specifically, see our guide to VPNs for WhatsApp calls.

How the Great Firewall actually works — the five layers

"The Great Firewall blocks it" is not one mechanism, it is five, and they fail differently. Knowing which layer stopped you is the difference between changing a setting that fixes the problem and changing settings at random for an hour. The layers below are not our theory — each is documented in peer-reviewed censorship measurement research, cited underneath.

• →Layer 1 — DNS tampering. When you look up a forbidden domain, a forged answer is injected on the path and arrives before the real one, so your device is handed an address that goes nowhere. Measurement work presented at USENIX FOCI 2020 (Triplet Censors) tested the top million domains over nine months and fingerprinted at least three distinct DNS injectors, each answering for its own overlapping set of domains.
• →Layer 2 — IP blocking. Known destination addresses are blackholed outright. This is the layer that catches VPNs indirectly: providers rent from the same hosting companies, so once a range is flagged, servers you have never connected to are already unreachable.
• →Layer 3 — keyword, URL and SNI filtering. The hostname you ask for travels in the clear even inside encrypted sessions. Research published at USENIX Security 2025 showed the firewall began inspecting the encrypted-looking QUIC handshake to read that hostname on 7 April 2024 — the first nationwide QUIC censorship anywhere — dropping subsequent traffic for roughly three minutes per flagged connection.
• →Layer 4 — deep packet inspection of encrypted traffic. Since November 2021 the firewall has blocked connections whose first packet looks like pure randomness instead of recognisable HTTPS or HTTP, using a handful of crude exemption rules (documented at USENIX Security 2023). This is why a protocol being encrypted does not help: looking random is itself the signal.
• →Layer 5 — active probing. If a server still looks suspicious, the censor connects to it directly, pretending to be a user (a technique measured and published at IMC 2015). If your server answers the way a circumvention tool answers, its address joins layer 2 — and it stops working for everybody, not just you.

Read those two dates together and the single most common traveller mistake explains itself. Plain WireGuard, IKEv2 and unwrapped OpenVPN all present a first packet that is indistinguishable from random data — precisely the pattern layer 4 has been dropping since late 2021. The VPN is not broken and your subscription is not the problem: the connection is being classified before it ever completes. What gets through is traffic shaped to look like an ordinary HTTPS session, which is what obfuscation (stealth mode) does.

Filtering also tightens around politically sensitive dates, and the pattern is on the public record rather than a rumour: Google's services were cut off across China in the days before the 25th anniversary of 4 June 1989, and every language edition of Wikipedia was blocked in the weeks before the 30th anniversary in 2019, having previously been only partly restricted. If your trip overlaps early June, the first week of October or a major political meeting, plan for a worse week than the one your friends describe.

Which VPN protocols survive the firewall

Given the layers above, protocol choice is not a performance preference in China — it decides whether you connect at all. The table maps each option to what the firewall sees and what realistically happens, with the anti-censorship modes each provider documents on its own site.

Are VPNs legal in China? The grey zone, and the case behind it

China does not ban VPN technology — it licenses it. Corporate and state-approved VPNs operate legally and are used daily by multinational firms; what is unauthorised is running or selling a circumvention service without approval. That distinction is where nearly every scary headline comes from, and it matters because the enforcement record targets operators, not tourists.

The case most often referenced without detail is worth stating precisely. A man surnamed Dai was detained on 10 October 2017 after setting up a website selling his own VPN service to several hundred customers. He was sentenced a year later, on 11 October 2018, to a three-year suspended prison sentence and a 10,000 yuan fine — reported at the time by CNN and Radio Free Asia. It was a prosecution for selling circumvention software, not for using one; there is no comparable documented record of a foreign visitor being prosecuted for connecting to a VPN on their own phone.

• →Using a foreign VPN as a visitor: extremely widespread, not the target of the enforcement cases on record. The realistic risk is technical (it stops working), not legal.
• →Selling or operating an unlicensed service: prosecuted, with the 2017-18 Shanghai case above as the reference point.
• →What actually changes your day: corporate policy and hotel networks, not police. If you are travelling for work, check what your employer's security team requires before you install anything.

If your VPN stops working in China: the fix list, in order

Connections die in China — that is the normal state of affairs, not a sign you picked wrong. Work through this list in order rather than reinstalling in a panic; the fix is usually two steps down, and each step targets a different one of the five layers above.

1. Turn on obfuscation / stealth mode. If the app has it and it is off, nothing else on this list matters. This is the single highest-yield change.
2. Force a different protocol. Move off plain WireGuard or IKEv2 and onto the provider's stealth option, or OpenVPN over TCP 443 if that is all the app offers.
3. Change server, then change region. Try a different server in the same nearby location first (Hong Kong, Tokyo, Singapore, Seoul); if the whole location is dead, the address range is probably blacklisted — jump regions entirely rather than retrying neighbours.
4. Switch networks. Hotel Wi-Fi, café Wi-Fi and mobile data are filtered inconsistently. Tethering off mobile data frequently connects when the hotel network will not.
5. Restart the connection cleanly. Disconnect, quit the app fully, toggle flight mode for ten seconds, reopen and reconnect. This clears a stale flagged flow — worth doing before anything drastic, because blocks are often time-limited rather than permanent.
6. Reinstall from what you already have. Use the installer or configuration files you saved before travelling. Do not count on reaching the provider's website or your app store from inside the country.
7. Email support — do not look for live chat. Provider websites are frequently unreachable from China, which takes the chat widget with them. Email still works and support teams keep current server recommendations and manual configuration files for exactly this situation.

Do you need a VPN in Hong Kong, Macau or Taiwan?

The Great Firewall is a mainland system. Hong Kong, Macau and Taiwan sit outside it, and the services in the table above — Google, YouTube, WhatsApp, Instagram — work normally there without any circumvention. If your itinerary is Hong Kong only, you are not facing the problem this page describes.

• →Multi-city itineraries are the catch. Fly into Hong Kong and take the train to Shenzhen and you cross into the filtered network mid-trip. Set everything up during the Hong Kong leg, while downloads and support pages still work.
• →There are still ordinary reasons to connect. Hotel and airport Wi-Fi are shared networks anywhere in the world, and a VPN keeps your own traffic private on them — the same reasoning as any other destination in our travel VPN guides.
• →Home content follows the usual rules. Your streaming subscriptions show the local catalogue in Hong Kong, Macau and Taiwan just as they would anywhere abroad; a home-country server restores the library you actually pay for.

The backup nobody mentions: roaming and travel eSIMs

There is a second route onto the open internet in China that has nothing to do with VPN software, and it is the reason eSIM companies rank on this search. The mechanism is home-routed roaming: when you use a foreign SIM or a travel eSIM, the local mast provides the radio signal but your data is tunnelled back to your home carrier's gateway before it reaches the internet — so it is not filtered by the mainland network you are standing on.

• →What it is genuinely good for: arrival day. It gets you a map, a ride-hailing app and a message home in the twenty minutes before you have sorted anything else out — the window where a failing VPN is most stressful.
• →What it costs: roaming data is priced per gigabyte and adds up fast. It is a backup, not a three-week plan.
• →What it does not do: it is not privacy. Your traffic is ordinary unencrypted traffic once it leaves the tunnel to your carrier, and it can be throttled or capped without notice.
• →The distinction that trips people up: a Chinese SIM or a Chinese carrier's eSIM is filtered exactly like any other domestic connection. The bypass comes from the traffic being routed abroad, not from the SIM being new.

Can a free VPN get through the Great Firewall?

Realistically, no — and the reason is structural rather than snobbery. Getting through the layers above requires continuously replacing servers as address ranges are blacklisted, plus obfuscation infrastructure that costs money to run. That is ongoing operational expense with no revenue behind it, which is precisely what a free tier cannot fund.

• →Domestic "free VPN" apps are the real hazard. An unlicensed circumvention app distributed inside a country that prosecutes unlicensed circumvention operators is not a service with an obvious business model. Treat anything in that category as untrustworthy with your traffic.
• →The one legitimate free option is Proton VPN's free tier, which comes from an established provider with a published privacy position — but it is limited in locations and speed, so treat it as a fallback rather than the plan.
• →The better route if budget is the issue: every provider on this page carries a 30-day money-back guarantee. Set one up before you travel, use it properly for the trip, and claim the refund afterwards if it did not deliver — you get real obfuscation infrastructure for the fortnight you actually need it.

Update log

• →10 August 2026 — Rebuilt the block list from GreatFire's public measurement data with per-domain test dates rather than a static list; added the five-layer firewall breakdown with its research citations, the protocol matrix, the legality section with the 2017-18 Shanghai case, the in-country troubleshooting order, the Hong Kong / Macau / Taiwan section and the roaming-eSIM backup. Existing rankings, testing notes and guarantees unchanged.
• →April 2024 onwards — Nationwide QUIC censorship began on 7 April 2024 (USENIX Security 2025), extending hostname-based filtering to a transport that previously slipped past it. Practical effect: UDP-based protocols lost one of their remaining advantages here.
• →November 2021 onwards — The firewall began dropping fully-encrypted, random-looking traffic (USENIX Security 2023). This is the change that made plain WireGuard and unwrapped OpenVPN unreliable in China, and it has not been reversed.

Entries are limited to documented, dated events. Our own in-country testing notes are recorded separately in the testing section above and are not restated here.