Landing in Beijing or Shanghai still catches visitors off guard. Google Maps freezes, WhatsApp refuses to send, and Instagram never loads. China's Great Firewall blocks these platforms along with thousands of other sites, and it actively hunts down the VPNs travelers install to get around the restriction. A trip that depends on staying connected needs preparation that starts well before boarding the plane.
Why the Firewall Is So Hard to Beat
China's internet censorship system does more than block addresses. It uses deep packet inspection, a technique that examines the shape and rhythm of data traffic to recognize VPN connections even when the content inside is encrypted. A standard VPN tunnel has a recognizable signature, and the firewall has gotten efficient at spotting it. This is why ordinary VPN connections often fail within days of arrival, even when they worked perfectly at home.
The response from VPN providers has been obfuscation: technology that disguises encrypted traffic as something unremarkable, such as regular web browsing. NordVPN built a protocol called NordWhisper for this purpose. Proton VPN uses Stealth, which wraps traffic to resemble a secure website connection. ExpressVPN applies obfuscation automatically without asking users to choose a protocol. Surfshark leans on Camouflage Mode through OpenVPN. Each company takes a different technical path, but none guarantees success, because the firewall's detection methods change constantly and both sides are locked in a continuous back-and-forth.
What Actually Needs to Happen Before You Fly
Because VPN websites and app stores are blocked inside mainland China, nothing can be downloaded or fixed once you've landed. Google Play doesn't function there, and Apple's Chinese App Store carries no foreign VPN apps. Preparation has to happen entirely beforehand:
- Install a primary VPN on every device, and sign in while you still have normal internet access.
- Add a second VPN with a different obfuscation method as a backup, since no single service works reliably every time.
- Download any manual configuration files, such as IKEv2 or WireGuard profiles, since app-based connections sometimes fail even when manual ones succeed.
- Test every connection before departure, including on a phone, since some providers report that manual setups on Windows face additional blocking.
- Enable the kill switch, which cuts internet access if the VPN connection drops, preventing unencrypted traffic from leaking through.
Servers closer to China, such as those in Hong Kong, Japan, Taiwan, and South Korea, generally offer lower latency than distant alternatives. Mullvad is a notable exception: the firewall blocks its Asian servers entirely, pushing users toward US-based connections that carry noticeably higher ping and slower browsing.
Speed, Trade-offs, and the Limits of Any Single Fix
Obfuscation carries a cost. Across the services tested on a Hong Kong server, download speeds generally stayed fast enough for 4K streaming, but upload speeds dropped sharply on several providers, which matters for anyone sending photos or large files. Distance and time of day compound the problem, since international bandwidth out of China tends to be most congested in the evening hours.
One detail worth separating from VPN performance is CN2 GIA, a premium routing option offered by China Telecom that reduces congestion on outbound traffic. It's unrelated to VPN obfuscation and does nothing to hide a VPN from detection, yet it's sometimes mentioned alongside VPN advice because it improves connection stability for subscribers who have access to it.
No provider covered here claims certainty in China, and periodic crackdowns on circumvention tools mean that what works one month may not work the next. That uncertainty is the real takeaway: redundancy, not any single app, is what keeps a traveler connected.