How the Great Firewall decides what gets through
Five years ago you could connect to almost any VPN server and get on with your day. That era is over. The firewall now runs several layers of detection at once:
- Deep packet inspection that examines the shape of your traffic, not just its destination
- Protocol fingerprinting that recognises the distinctive handshakes of OpenVPN and WireGuard
- IP blacklisting that can block a known VPN server within hours of it appearing
- Active probing that connects to a suspected VPN server to confirm what it is
The system has one structural weakness: it can't block everything that looks like ordinary encrypted web traffic without breaking the business internet China depends on. That gap is what the surviving providers aim at. A VPN works in China when its traffic is indistinguishable from a normal HTTPS session, which is why obfuscation, not server count or headline speed, is the feature that decides survival.
That's also why most VPNs fail there. Standard protocols carry signatures the firewall recognises instantly, and keeping ahead of its updates takes constant engineering that most providers understandably won't fund for one market.
The three providers, in the order we rank them
The gallery at the top of this page ranks Astrill first, NordVPN second and Proton VPN third, each with the documented record behind the call. Here's the longer form of the same argument.
Astrill VPN: built around China
Astrill has kept people online inside China for longer than almost any provider still standing. Expats and businesses have leaned on it since the early 2010s, and that focus shows: holding a connection through the Great Firewall is the problem Astrill was built around, not a feature bolted on later.
Astrill VPN from $12.50/mo on the 2-year plan, billed in USD→
StealthVPN is the reason to consider it. It disguises traffic so deep packet inspection struggles to recognise a VPN at all, which is precisely the detection the firewall leans on. OpenWeb handles everyday browsing, and router support covers a whole flat or office from one connection.
The honest trade-off is price, and it's not close: Astrill costs several times what the other two charge, publishes no money-back guarantee, and we could find no independent no-logs audit. For a short trip that stings. For anyone living or working in China, where a dropped connection means no email and no banking, the case for paying the premium is that connectivity is the one job Astrill's whole product is organised around.
Before you fly: Astrill's main website is routinely unreachable from inside China. Buy the subscription and install the apps on every device before you cross the border; downloading anything VPN-shaped from inside is far harder than doing it at home.
NordVPN: the strongest all-rounder with a China mode
NordVPN is second here for one reason only: China isn't its speciality. For everything else on the trip it's the stronger everyday service, with the largest published server network of the three, a no-logs policy with a named independent audit, and a refund route written into its terms.
NordVPN from £3.11/mo on the 2-year plan→
Its obfuscated servers are the part that matters for China: they wrap the tunnel so it reads as ordinary HTTPS. Two practical notes from its own documentation: obfuscation has to be switched on manually in settings, and app updates are hard to fetch from inside China, so update everything before you travel.
Proton VPN: the privacy-first pick
Proton VPN takes a different route. Its Stealth protocol is open source, its apps are open source, its no-logs policy carries a named independent audit, and it operates under Swiss jurisdiction. If your first concern is who can see your traffic rather than whether Saturday's video call connects, that transparency is the draw.
Proton VPN from £3.99/mo on the 2-year plan→
Its China record is the thinnest of the three, and traveller reports describe more manual server and protocol switching than with the other two, particularly when filtering tightens. Secure Core, which routes traffic through privacy-friendly countries before it exits, adds protection at a further cost in speed.
Set up everything before you fly
The most common failure isn't technical. People arrive, discover Google and WhatsApp don't load, and only then try to download a VPN, by which point the provider sites may be unreachable and the app stores are restricted. Do all of this before you leave:
- Subscribe from home. Payment processing from inside China is unreliable, and the providers' own sites are often unreachable there.
- Install on every device you might conceivably use: phone, tablet, laptop. You won't be able to add one later.
- Test the connection and contact support while you can still reach them easily.
- Save support email addresses offline. Email usually gets through when websites don't.
- Download and test the manual configurations your provider currently supports, and keep offline screenshots of the setup instructions; availability varies by provider and platform, and a manual OS-level connection is the fallback if the app itself is blocked.
- Switch auto-renew on so the subscription can't lapse while you're somewhere you can't pay.
Then configure more than one route out. Set your provider's China-oriented protocol as the primary (StealthVPN for Astrill, obfuscated servers for NordVPN, Stealth for Proton VPN). Add OpenVPN TCP on port 443 as the second option; it imitates HTTPS closely enough to slip through periods when flashier protocols are being squeezed. Keep whichever manual profile your provider currently supports as the last resort. Know how to switch between all of them before you're doing it on hotel wifi.
Is a VPN legal in China?
China regulates cross-border telecommunications services: providers need government approval, and unauthorised VPN services are illegal at the provider level. Rules and enforcement can change and may depend on the facts. This is not legal advice: check current official guidance and seek qualified local advice before travel.
Sensible practice if you use one: don't advertise the fact on Chinese platforms, don't use it to publish politically sensitive material, and don't sell or share access. Laws and enforcement patterns shift, so check the current advice before you travel rather than relying on any guide, including this one.
Sensitive dates change everything
Filtering is not constant. It visibly tightens around a predictable calendar:
- The National People's Congress meetings, typically March
- Early June, around the Tiananmen Square anniversary
- National Day on 1 October
- Major political events, and international incidents involving China
During those windows, traveller reports describe the same pattern across all three providers: more dropped connections, more server-hopping, slower speeds, and obfuscated protocols holding on where plainer ones give out. If your trip overlaps one of those dates, plan for the connection to need more babysitting, and schedule anything that genuinely matters for early morning, when reports suggest the squeeze is lighter.
When things get bad, work the list: hop servers every few hours, cycle protocols rather than retrying the blocked one, and try mobile data with a local SIM when hotel wifi won't cooperate. Mobile networks are widely reported to filter less aggressively than fixed broadband, and switching between the two is free to try. If your stay is long or the stakes are high, accounts with two different providers is cheap redundancy.
If nothing connects at all
Complete blackouts are rare but real, usually around the dates above. Two fallbacks worth knowing about:
SSH tunnels and SOCKS proxies. If you have a server outside China through work or a personal VPS, an SSH tunnel looks like the ordinary administrative traffic that businesses depend on, which is exactly why the firewall is reluctant to block it wholesale. It takes technical comfort to set up, and a SOCKS proxy is weaker protection than a VPN, but both have kept people reachable through crackdowns.
Your provider's support channel. All three publish support email addresses, and email tends to survive when websites don't. Astrill's support in particular deals with China connection problems all day; if a protocol stalls, support can often hand over a working configuration. Save the addresses before you travel.
Paying from inside China
Buy before you go; that's the whole strategy. If you do need to renew from inside, card payments routed through a Chinese IP are often flagged or refused. The workable route is usually cryptocurrency, which the big providers accept in some form, paid through your existing connection. Check your provider's payment page for what it currently takes before you rely on this, and treat it as the backup plan rather than the plan.
What performance to expect
Slower than the same service outside China. That's the honest headline, it applies to every provider on this page, and it's the price of pushing disguised traffic through the firewall. Expect enough for video calls, 720p to 1080p streaming and normal browsing on a good day, with more variability than you're used to. Server choice matters: Japan, Singapore and South Korea are the usual first picks in traveller reports, with the US west coast as the stable-but-slower fallback. Skip Hong Kong; since 2020 it sits under the same censorship pressure as the mainland.
Filtering also isn't uniform. It differs between cities, between ISPs in the same city, and between one week and the next, and there is no trustworthy public dataset of per-city VPN success rates, so we won't invent one. Your own ISP and the timing of your trip are the two factors most likely to decide how your connection behaves.
Final thoughts
Go in with realistic expectations and the preparation done. Astrill is the pick when getting through is the only question that matters and the budget can take it. NordVPN is the pick for everyone whose trip includes China rather than revolving around it. Proton VPN is the pick when privacy is the point. Install everything before you fly, configure your fallbacks, and you've given yourself the best odds available.
If your travels also involve keeping up with UK services, our guides to watching Channel 4 abroad and Sky Sports abroad cover the streaming side of the same problem.
