Best VPN Protocol for China: What Still Works

Best VPN protocol for China

The best VPN protocol for China in 2026 is one disguised as ordinary web traffic, going by the sources we found, but none works for everyone and no 2026 study settles it. We haven’t tested any VPN or protocol in China. This page summarizes our protocol guides and what providers, researchers and users report, with dates.

• Getting through for some users in 2026. Protocols disguised as ordinary web traffic. Many 2026 reports of working setups involve VLESS with REALITY on users’ own servers, or a provider’s stealth mode such as Astrill’s StealthVPN and OpenWeb. Some users also report plain WireGuard to a home router, or Shadowsocks, working. Each of these has failed for other users.
• Routinely blocked. Plain OpenVPN, which Astrill says “is often blocked in China”.
• Hit by large blocking waves. Since November 6, 2021, the firewall has blocked fully encrypted proxies such as Shadowsocks and VMess automatically, in real time, on part of the traffic to popular data centers. TLS-based proxies such as Trojan and VLESS over TLS were reported blocked in large numbers from October 3, 2022.
• Easy to spot, reports mixed. WireGuard’s own docs say it “does not focus on obfuscation”, meaning disguising its traffic, and Astrill says IPsec connections can be fingerprinted. Even so, Surfshark recommends WireGuard for China, NordVPN recommends IKEv2/IPsec, and some users report both working.
• Why the answer changes. The firewall adds new detection in waves and blocks servers’ addresses as well as protocols. See why a protocol that works today can stop working.

Our protocol guides have the research and reports in detail: OpenVPN in China, WireGuard in China, Shadowsocks in China and V2Ray, VLESS and REALITY in China.

Which VPN protocol works in China?

No protocol works for everyone in China, but disguised protocols have more 2026 reports of getting through than standard VPN protocols, going by the dated sources in this table. None of these sources is a 2026 measurement inside China. “Not confirmed” means sources disagree or say nothing recent.

Protocol	What sources report	Sources	Our page
OpenVPN, a standard open-source VPN protocol	Often blocked. Astrill says OpenVPN “is often blocked in China”. In August 2021, researchers identified 1,718 of 2,000 plain OpenVPN connections, and 34 of 41 “obfuscated” VPN setups, on a network outside China. In July 2026, a Reddit user who said they had lived in China for almost a decade wrote: “OpenVPN protocols are all blocked.”	Astrill, accessed Oct 19, 2026; USENIX Security 2022, Aug 2022; Reddit, Jul 2026	OpenVPN in China
WireGuard, an open-source VPN protocol that runs over UDP, a way of sending data without setting up a connection first	Mixed. WireGuard “does not focus on obfuscation”, its docs say, and Xray’s docs say its “fixed UDP signature is easy to identify and block”. Surfshark still recommends a manual WireGuard connection from China. On October 1, 2026, a traveler said WireGuard to their home router worked well during a two-week trip; on October 6, another user said theirs “wouldn’t get any handshakes” for about a month. Not confirmed.	WireGuard, accessed Oct 19, 2026; Xray docs, accessed Oct 19, 2026; Surfshark, Oct 2026; Reddit, Oct 1 and Oct 6, 2026	WireGuard in China
IKEv2/IPsec, a standard VPN protocol	Mixed. NordVPN’s China pages give manual IKEv2/IPsec setups as their workaround, but its Windows page says its server configurations for manual connections “have recently been blocked”. Astrill wrote in September 2026 that IPsec opens connections “in distinctive ways that DPI systems can fingerprint”; DPI, or deep packet inspection, looks inside traffic. A Net4People user said their IKEv2 VPN was blocked on October 3, 2022; an account that sells routers said in September 2025 that IKEv2 to servers on home connections works. Not confirmed.	NordVPN, iOS, Mar 2026; NordVPN, Windows, Nov 2025; Astrill, Sep 2026; Net4People, Oct 2022; Reddit, Sep 2025	NordVPN manual setup in China
Shadowsocks, an encrypted proxy designed to look like random bytes	Mixed. The firewall has detected Shadowsocks servers since 2019. Since November 6, 2021, it has blocked fully encrypted traffic like Shadowsocks in real time on part of the traffic to popular data centers. In September 2026, one Reddit user said Outline “basically runs shadowsocks which is fully blocked in china”; another replied, “I often use outline and it works just fine.” Not confirmed.	IMC 2020, Oct 2020; USENIX Security 2023, Apr 2023; Reddit, Sep 2026	Shadowsocks in China
VMess, or VLESS over TLS, in V2Ray or Xray	Hit by large blocking waves. VMess is fully encrypted, and was among the protocols blocked in real time from November 6, 2021. From October 3, 2022, more than 100 users reported TLS-based servers blocked, naming “trojan, Xray, V2Ray TLS+Websocket, VLESS, and gRPC”. Xray’s docs say VMess traffic patterns “can still be classified”.	USENIX Security 2023, Apr 2023; GFW Report, Oct 2022; Xray docs, accessed Oct 19, 2026	V2Ray in China
VLESS with REALITY, in Xray	Works for some users in 2026, going by user reports. REALITY, released on March 9, 2023, borrows a real website’s TLS handshake. Its designer, Xray developer RPRX, said in November 2024 that it had no reports of large-scale blocking. In 2026, users described a home REALITY server that “has been up for 3 years” and a setup that is “basically bulletproof”, while another said theirs “got throttled down”. Researchers have published ways to detect REALITY servers; whether the firewall uses them is not confirmed.	Xray history, accessed Oct 19, 2026; Net4People, Nov 2024; Reddit, Jul 2026 and Sep to Oct 2026	V2Ray in China
Trojan, a proxy that imitates HTTPS; V2Ray and Xray also run it	Not confirmed for 2026. Trojan “imitates the most common protocol across the wall, HTTPS”, its docs say. It was among the TLS-based tools reported blocked in large numbers from October 3, 2022. In a 2023 test outside China, researchers detected over 70% of connections from Trojan and three other proxies in their standard setups, by the TLS handshakes inside them. We found no 2026 report on Trojan in China.	Trojan docs, accessed Oct 19, 2026; V2Ray and Xray docs, accessed Oct 19, 2026; GFW Report, Oct 2022; USENIX Security 2024, Aug 2024	None yet
Hysteria2, a proxy built on QUIC, the newer web protocol behind HTTP/3, which runs over UDP	Not confirmed for 2026. Hysteria runs on “a customized QUIC protocol” and “masquerades as standard HTTP/3 traffic”, its site says. Since April 7, 2024, the firewall has blocked QUIC connections by the site name they carry, and a July 2025 paper found Hysteria’s own domain and “users’ custom domains used for Hysteria proxies” blocked. The paper says Hysteria 2.6.2, released June 7, 2025, took in a library update that gets around this blocking. RPRX wrote in November 2024 that QUIC proxies such as Hysteria had reports of large-scale blocking in the past but were “basically usable” (our translation). Hysteria’s docs say users in China “sometimes report that their ISPs block or throttle persistent UDP connections”.	Hysteria, accessed Oct 19, 2026; Hysteria docs, accessed Oct 19, 2026; USENIX Security 2025, Jul 2025; Net4People, Nov 2024	None yet
Astrill StealthVPN and OpenWeb, Astrill’s own protocols	Works for some users, with failures. StealthVPN is “inspired by OpenVPN” with extra obfuscation; OpenWeb runs over TCP and its traffic “looks like regular website browsing”. Both work only in Astrill’s apps. Astrill’s FAQ says StealthVPN is hard to detect and block in countries “like China”. A review that earns commissions found Astrill the most consistent VPN across its team’s trips, which included spring and summer 2026; its author used both protocols and still had failed connections. On October 1, 2026, a traveler said Astrill “worked fine”; the next day, another user in the same thread called it “straight up broken”.	Astrill, accessed Oct 19, 2026; Astrill FAQ, accessed Oct 19, 2026; Unusual Nomad, Oct 2026; Reddit, Oct 2026	Astrill
ExpressVPN’s Lightway and automatic obfuscation	Mixed. Lightway is ExpressVPN’s own protocol, over UDP or TCP, and ExpressVPN says it “uses automatic obfuscation on supported platforms” without naming protocols. Its China page lists Automatic and Lightway first. The same commission-earning review found ExpressVPN “too inconsistent overall”, and in an October 11, 2026 Reddit thread, the poster and several replies said it doesn’t work in China. Not confirmed.	ExpressVPN, Feb 2026; ExpressVPN features, Oct 2026; Unusual Nomad, Oct 2026; Reddit, Oct 2026	ExpressVPN
NordWhisper, NordVPN’s own protocol	Not confirmed. NordWhisper works by “making your VPN traffic resemble regular web traffic”, and NordVPN’s Obfuscated servers moved to it from May 2026. NordVPN’s China pages don’t mention it. In July 2026, a user in China said they couldn’t connect after the Obfuscated servers stopped using OpenVPN; an account named NordVPN_ProductTM replied that it couldn’t reproduce the problem.	NordVPN, May 2026; NordVPN, Apr 2026; Reddit, Jul 2026	NordVPN
Surfshark’s obfuscated servers, for OpenVPN	Not confirmed. Surfshark’s OpenVPN connections use obfuscated servers, which run “a modified version of the OpenVPN protocol”. Surfshark says obfuscated servers alone “can’t guarantee that your VPN provider will work in China”, and its China page recommends manual WireGuard instead.	Surfshark, Apr 2026; Surfshark, Sep 2026; Surfshark, Oct 2026	Surfshark
Mullvad’s and Proton’s obfuscation: QUIC, LWO and others; Stealth	Mixed. Mullvad says the firewall blocks all Mullvad servers in Asia and suggests US servers with its obfuscation settings. On October 16, 2026, a user said Mullvad connected only after they switched to QUIC. Proton’s Stealth wraps VPN traffic “in an obfuscated TLS tunnel over TCP”; on September 30, 2026, Proton’s support team blamed “enhanced government blocking of VPNs” for connection trouble in mainland China.	Mullvad, Apr 2026; Reddit, Oct 2026; Proton, accessed Oct 19, 2026; Reddit, Sep 2026	Which VPN works in China now

VPN protocols blocked in China

Plain OpenVPN is the protocol sources most often describe as blocked in China, and whole families of proxies have been blocked in large waves since 2021. Research and reports describe four patterns.

• Standard VPN protocols are easy to recognize. Astrill wrote in September 2026 that “Protocols like OpenVPN and IPSec open connections in distinctive ways that DPI systems can fingerprint”. In February 2024, a server operator on Net4People wrote that crackdowns before political meetings hit servers running “easily detected VPN protocols”, and named “PPTP, OpenVPN, IKEv2, Wireguard”. An analysis of documents leaked from Geedge Networks, which GFW Report calls a core technical force behind the Great Firewall, says its hardware “can also identify popular VPN protocols like IPSec, OpenVPN and WireGuard” (InterSecLab, September 2025).
• Fully encrypted proxies. Since November 6, 2021, the firewall has blocked traffic in which every byte looks random, such as Shadowsocks and VMess, in real time. Researchers found it applied this only to IP ranges of popular data centers, and only to about a quarter of connections to them (USENIX Security 2023).
• TLS-based proxies. Starting October 3, 2022, more than 100 users reported TLS-based servers blocked, Trojan, Xray and VLESS among them. The firewall blocked the port the server used; users who moved to another port could then lose the whole IP address (GFW Report).
• QUIC. Since April 7, 2024, the firewall has blocked QUIC connections that carry a blocked site name, by dropping the client’s packets for three minutes. The researchers called it the first known case of this kind of lingering block for a protocol that runs over UDP. Their July 2025 paper says this filtering is “effectively blocking many QUIC proxies at the outset”, and names Hysteria among those affected.

REALITY, which borrows a real website’s handshake, had no reports of large-scale blocking as of November 2024, according to its designer. Our guides cover each family: OpenVPN, WireGuard, Shadowsocks, and V2Ray, VLESS and REALITY.

Best ExpressVPN protocol for China

ExpressVPN’s own answer is Automatic: its China page, updated February 4, 2026, says to try Automatic first and then work down a fixed list, testing each protocol with the Fastest location option.

Device	Order ExpressVPN gives for China
Windows, Mac, iPhone and Linux	Automatic, Lightway UDP, Lightway TCP, WireGuard, OpenVPN
Android	Automatic, Lightway TCP

• What Automatic picks. ExpressVPN’s protocols page, updated in August 2026, says that on Automatic, “ExpressVPN will choose the best option for your network—which is usually Lightway”. It adds that IKEv2 “will sometimes be used” when the setting is Automatic.
• What Lightway is. ExpressVPN’s own protocol, “built from the ground up by ExpressVPN”. It uses the wolfSSL library and runs over UDP or TCP, and ExpressVPN has published its source code. The protocols page’s verdict on it is “Always try Lightway first”.
• Obfuscation. ExpressVPN’s features page says it “uses automatic obfuscation on supported platforms” when networks try to block VPN traffic. It doesn’t say which protocols or platforms that covers.
• What users report. Reports in 2026 are mixed. Unusual Nomad, which earns commissions, said ExpressVPN “connected on some networks” on its author’s trip but was “too inconsistent overall” (October 2026). In an r/chinalife thread started October 11, 2026, the poster and several replies said ExpressVPN doesn’t work in China. None named a protocol.

ExpressVPN’s China page has its steps for changing protocol on each device. Our ExpressVPN page has its overall status.

What other VPNs recommend for China

Each VPN we cover points China users to a different protocol, according to its own help pages, and none promises that it will work.

VPN	What its own pages recommend for China	Page date
Astrill	StealthVPN or OpenWeb, its own protocols. Its FAQ says StealthVPN is hard to detect and block in countries “like China”, and its protocols page says OpenVPN is often blocked there. Its protocols page lists OpenWeb for iOS but not StealthVPN, and its September 2026 guide says the iPhone app offers only UDP and TCP and doesn’t let you choose a protocol.	Protocols page and FAQ, accessed October 19, 2026; guide for restrictive networks, September 29, 2026
ExpressVPN	Automatic, then Lightway UDP, Lightway TCP, WireGuard and OpenVPN; on Android, Automatic, then Lightway TCP	February 4, 2026
NordVPN	A manual IKEv2/IPsec connection, because it says its iPhone and Android apps are “fully blocked” in China. On Windows, it says its “server configurations for manual connections and applications have recently been blocked”.	iPhone page, March 2026; Android page, April 2026; Windows page, November 2025
Surfshark	“At the moment, we strongly recommend connecting manually using the WireGuard protocol if you can’t connect via the Surfshark app.”	October 2, 2026
Mullvad	Servers in the US with its obfuscation settings, because “the great firewall of China is blocking all Mullvad servers in Asia”	April 22, 2026
Proton VPN	Its Stealth protocol, which makes traffic look like a regular HTTPS connection, plus its “alternative routing” feature	Undated; accessed October 19, 2026

NordVPN’s general guide for countries that restrict VPNs, edited August 10, 2026, suggests NordWhisper, Obfuscated servers, OpenVPN (TCP) and a manual IKEv2 connection, but says it has “different steps to follow if you are connecting from China”. NordVPN describes NordWhisper as built for “restrictive local network environments” such as office, campus and hotel Wi-Fi. Our NordVPN manual setup guide covers its IKEv2 steps for China.

Do VPNs work in China?

Some VPNs work in China for some people, but none works reliably, going by 2026 reviews, provider notices and user reports.

• A hands-on review. Unusual Nomad, which earns commissions, said Astrill was the most consistent VPN on its team’s trips, which included spring and summer 2026. NordVPN and Surfshark “needed more intervention”, and ExpressVPN was too uneven to be its main recommendation (October 18, 2026).
• Providers. NordVPN says its apps are fully blocked in China and gives manual setups instead. On September 30, 2026, Proton’s support team said trouble in mainland China came from “enhanced government blocking of VPNs”.
• A 2026 crackdown. ABC News reported in June 2026 that, according to US-based censorship analyst Eric Liu, a new round of crackdowns on VPNs began in April, and telecom carriers in parts of China were asked to block all VPN services.
• Users. October 2026 reports conflict even for the same VPN, as the Astrill reports in the table above show.

For this month’s reports on each VPN, see which VPN works in China now, and for fixes, VPN not working in China. Whether you may use one is a separate question, covered in our guide to whether VPNs are legal in China. If you mainly need your phone online, compare the options in our eSIM or VPN for China guide.

Why a VPN protocol that works today can stop working

A protocol that works today can stop when the firewall adds a new way to detect it, when your server’s address gets blocked, or during a crackdown, and researchers and providers have documented each of these.

New detection arrives in waves

• The waves so far. The research on this page dates four. Active probing of Shadowsocks servers, where the firewall connects to suspected servers to test them, began in May 2019. Real-time blocking of fully encrypted traffic began on November 6, 2021, large-scale blocking of TLS-based proxies on October 3, 2022, and QUIC blocking on April 7, 2024.
• Escapes can be temporary. The 2021 system left UDP traffic alone, and researchers called switching to UDP or QUIC “merely a stopgap measure, as the censor can enable their censorship for UDP” (USENIX Security 2023). The QUIC blocking that began in 2024 reads UDP traffic.
• Timing. GFW Report wrote in October 2022 that “Chinese censors always start using their new censorship weapons on a large scale a few days or weeks before a politically sensitive event”. ABC News reported in June 2026, citing Eric Liu, that VPN trouble often follows the installation of new censorship technology, and can come during events such as the national congress weeks in March or the Tiananmen Square anniversary on June 4.

Servers get blocked, not just protocols

• Address lists. Mullvad says firewalls in countries that block VPNs use “lists of known VPN server IP addresses” as well as deep packet inspection. In the October 2022 wave, the firewall blocked a server’s port first, and users who moved to another port could lose the whole IP address.
• Leaked lists. A February 2026 analysis of the Geedge leak found files that map VPN infrastructure, including NordVPN server lists (GFW Report, FOCI 2026).
• Setup choices. In March 2026, Xray’s release notes said that, from recent experience, two kinds of REALITY setups “very easily” got the server’s IP address blocked, and added warnings for both (our translation).

Detection research keeps moving

• Proxies in general. Starting March 16, 2023, researchers ran a detector for 30 days at an ISP serving over a million users in a country with minimal censorship. It caught over 70% of connections from VMess, Shadowsocks, VLESS and Trojan in their standard setups, by the TLS handshakes inside them. It was a test of what a censor could do, published in August 2024, not a measurement of the Great Firewall.
• REALITY. A proof-of-concept tool published on May 31, 2025 detected REALITY servers, and Xray released a first fix on June 8, 2025. A different detection method was posted on February 16, 2026, and Xray changed REALITY again on March 27, 2026. Whether the firewall uses either method is not confirmed.
• VPN protocols. The Geedge leak analysis says its system identifies IPsec, OpenVPN and WireGuard (InterSecLab, September 2025). Whether the national firewall uses the same rules is not confirmed.

Rules differ by place and moment

• Provinces. Researchers measured a separate provincial firewall in Henan, which users’ reports date to August 2023, and found that at some points it blocked ten times as many websites as the national one (IEEE S&P 2025). In August 2026, a Net4People user who said they were not a networking professional reported that most circumvention providers had stopped working in Fuzhou, Fujian, while “A small number of providers using v2ray remain functional”.
• Regions. In December 2025, a Net4People user wrote that WireGuard “works in some places but not others” in China.
• Sudden outages. On August 20, 2025, for about 74 minutes, the firewall injected forged packets that disrupted all connections on TCP port 443, the port HTTPS uses, between China and the rest of the world (GFW Report). GFW Report called the injection unconditional: it didn’t depend on what the traffic looked like.

Providers and developers say the same. Astrill wrote in September 2026: “Obfuscation is not magic, and no method works forever. Filtering systems get updated, and providers respond with updates of their own.” Proton’s China page says “China changes its blocking methods frequently”. In September 2025, NaiveProxy’s developer wrote on Net4People that “the protocol design itself is a poor indication of its survival in real world conditions”.