Landing in Beijing or Shanghai typically means discovering, within minutes, that familiar digital habits no longer work. Google Maps refuses to load, WhatsApp messages sit unsent, and Instagram shows nothing at all. The cause is China's Great Firewall, a vast filtering system that blocks thousands of foreign websites and apps, and which has grown increasingly skilled at detecting and shutting down the VPNs travelers use to get around it.
Why the Firewall Is So Hard to Outrun
A VPN works by encrypting a device's internet traffic and routing it through a server elsewhere, hiding both the content of that traffic and its destination. Ordinarily, this is enough to bypass geographic restrictions. China's filtering apparatus, however, uses deep packet inspection, a technique that examines the shape and rhythm of data rather than just its destination, to identify patterns typical of VPN encryption. Once flagged, that traffic is simply dropped. This is why providers have built obfuscation tools that disguise VPN traffic as something else entirely, often ordinary encrypted web browsing, in an attempt to slip past inspection undetected.
No major VPN company guarantees success inside China, and that caveat matters. Firewall enforcement shifts without warning, varies by region, and tends to intensify around political events. Travelers who treat a VPN as a guaranteed utility, rather than a tool with a real chance of failure, often find themselves cut off entirely.
What Actually Works, and What Doesn't
Among the providers tested from outside China, using a Hong Kong server as the closest available point to the mainland, obfuscation protocols produced noticeably different results. Tools built specifically to mimic standard web traffic, such as NordVPN's NordWhisper and ExpressVPN's automatic obfuscation, tended to hold up better than general-purpose encryption settings. Proton VPN's Stealth protocol worked but ran slower in testing. Surfshark's manual OpenVPN configuration, selected deliberately rather than left on automatic, also performed well. Mullvad presented a different problem altogether: China blocks its Asian servers outright, forcing a reroute through the United States, which adds distance and latency even when the connection holds.
Astrill, a provider built specifically around operating behind firewalls, offers a "Smart Mode" that separates domestic and international traffic, letting Chinese apps function normally while foreign services route through the encrypted tunnel. It is also considerably more expensive than mainstream consumer VPNs.
- Set up and test every VPN before departure - app stores and VPN websites are blocked inside China.
- Install a second VPN with a different obfuscation method as backup.
- Download manual configuration files in advance, since in-app downloads won't work on the mainland.
- Enable the kill switch, which blocks internet traffic if the VPN connection drops, before boarding.
- Expect upload speeds to suffer more than downloads under obfuscation.
The Bigger Picture: Censorship, Privacy, and Shifting Ground
The cat-and-mouse dynamic between VPN developers and state censorship systems is not unique to China, but it is the most advanced example of it. Enforcement sweeps, including one reported in April 2026 that disrupted proxy services relying on premium routing networks, show how quickly the landscape can change. A method that works reliably one month can be blocked the next, which is why providers increasingly discourage relying on a single tool.
For travelers, the practical lesson extends beyond China. VPN reliability behind any restrictive firewall depends less on marketing claims and more on redundancy, preparation, and an understanding that these tools are not infallible. Encryption and obfuscation can disguise traffic, but they cannot promise passage through a system actively designed to detect and block exactly that kind of concealment.