Does OpenVPN Work in China?

Does OpenVPN work in China?

Plain OpenVPN often doesn’t work in China in 2026. Astrill says OpenVPN “is often blocked in China”, and most users who reported on it in 2025 and 2026 said it failed, though a few said OpenVPN to their own server still worked. We haven’t tried OpenVPN in China. This page reports what researchers, providers and users say, with dates.

• Research. No study we found measures OpenVPN inside China. A 2022 study on a US network showed that OpenVPN, and most of the “obfuscated” versions VPN providers sold, can be identified with very few false alarms.
• Leaked documents. A September 2025 analysis of documents leaked from Geedge Networks says its filtering system identifies OpenVPN. Geedge works for Chinese provinces and for other countries. Whether the national firewall uses the same rules is not confirmed.
• 2025 and 2026 reports. Most say plain OpenVPN is blocked. In July 2026, a user who had lived in China for almost a decade wrote that “OpenVPN protocols are all blocked”. In March 2025, another said OpenVPN to a home server had worked for them for several years.
• Providers. Astrill and NordVPN point China users to other protocols. ExpressVPN lists OpenVPN last of five to try. Surfshark uses OpenVPN only on obfuscated servers but recommends WireGuard from China.

To compare OpenVPN with other protocols, see our guide to the best VPN protocol for China.

What OpenVPN is

OpenVPN is a free, open-source VPN program, first released in 2002, and the protocol it speaks. It uses the OpenSSL library for encryption and agrees on keys with a handshake based on TLS, the encryption behind HTTPS websites. It runs over UDP by default or over TCP, on port 1194, a numbered entry point on the server, unless set otherwise. A 2022 study called it the most popular protocol for commercial VPN services, and OpenVPN Inc. makes the official app, OpenVPN Connect.

Is OpenVPN blocked in China?

Plain OpenVPN often is, going by Astrill and most user reports, but not everywhere and not all the time. No research we found has measured it.

• What a provider says. Astrill’s protocols page says: “Since OpenVPN does not aim to hide its traffic, it is easily detectable by automated firewall systems and frequently blocked and throttled. E.g. it is often blocked in China.”
• It varies by place and time. Net4People users reported a slightly obfuscated OpenVPN getting through in Quanzhou in May 2023, and crackdowns before political meetings that hit easily detected protocols, OpenVPN among them, in February 2024. See the forum reports below.
• How it shows up. In the reports we found, blocking looked like a connection that was “flaky” (2021), a server port that stopped working after a few months (2024), or a connection that didn’t work at all (reports from 2024).
• Other countries. In August 2023, a Net4People post relayed reports from Russian users of blocked OpenVPN and WireGuard connections to foreign servers, across many internet providers. Some users there said the trigger was a set number of data packets after the handshake.

How China’s firewall detects OpenVPN

No published study shows how China’s firewall detects OpenVPN. The sources show three things: plain OpenVPN is easy to recognize, the firewall already uses against Shadowsocks the same two-step method that researchers used to catch OpenVPN, and leaked documents say Geedge’s filtering system identifies it.

Why plain OpenVPN is easy to recognize

The 2022 study “OpenVPN is Open to VPN Fingerprinting” found three fingerprints, based on “byte pattern, packet size, and server response”.

• A readable header. Each OpenVPN packet carries a header that “is not part of the encrypted payload”: 24 bits over TCP, 8 bits over UDP. It starts with an opcode that names the message type. A session opens with a client reset, a server reset and a TLS handshake, so the first packets follow a known pattern.
• Same-size acknowledgments. Because the handshake needs a reliable channel, OpenVPN acknowledges each handshake packet with its own ACK packet. These are “uniform in size” and appear mostly at the start of a session.
• Servers that give themselves away. A plain OpenVPN server answers a client reset with a server reset. With the tls-auth or tls-crypt options, it stays silent instead, but the researchers still identified such servers by how quickly they closed connections and by how many bytes it took to trigger a reset.
• A default port. OpenVPN’s manual says port 1194 is “the official IANA port number assignment for OpenVPN”; IANA is the body that assigns port numbers. Astrill’s September 2026 guide notes that OpenVPN “commonly runs on UDP port 1194” and that a restrictive firewall “can block those default ports outright”.

OpenVPN’s own options help only partly. Its manual says tls-crypt “makes it harder to identify OpenVPN traffic as such”. The 2022 study notes that tls-crypt encrypts the contents of OpenVPN’s control messages but not the packet headers.

What research on the firewall shows

• 2020: the two-step method. GFW Report’s Shadowsocks study found the firewall uses the length and entropy, or randomness, of a connection’s first data packet to flag likely Shadowsocks traffic, then “sends seven different types of active probes” to the server to check its guess (IMC 2020, published October 2020). It lists VPN Gate “and other VPN services” among the targets that earlier reports found the firewall probing. It doesn’t test OpenVPN.
• 2021: the same method, built for OpenVPN. The 2022 study’s authors built a detector “inspired by the architecture of the Great Firewall”: a passive filter, then active probes. From August 13 to 20, 2021, they ran it on Merit, a regional research and education network in Michigan that serves about a million users. It identified 1,718 of 2,000 plain OpenVPN connections, covering 39 of 40 configurations, and 34 of 41 “obfuscated” configurations from commercial VPNs. The filter flagged an OpenVPN connection after a median of 7.9 seconds. The authors concluded that “tracking and blocking the use of OpenVPN, even with most current obfuscation methods, is straightforward and within the reach of any ISP or network operator, as well as nation-state adversaries”. The study was published in August 2022 and wasn’t done in China.
• 2021: a system built for fully encrypted traffic. From November 6, 2021, China’s firewall blocked “fully encrypted” protocols such as Shadowsocks and VMess, which are designed so that every byte looks random and have “no identifiable headers” (GFW Report, USENIX Security 2023, published April 2023). The paper doesn’t mention OpenVPN, so whether this system affects it is not confirmed.
• 2024: Chinese research on finding VPN servers. In May 2024, researchers at the Institute of Information Engineering of the Chinese Academy of Sciences, home of the MESA Lab named in the Geedge leak, published a method for identifying VPN servers. It sends probes for several protocols, including OpenVPN, and the authors wrote that many VPN servers still use “traditional protocols” such as PPTP, IPsec, SSTP and OpenVPN. They tested it at an unnamed internet provider (ACM Web Conference 2024). A February 2025 Net4People review called the evaluation “problematic”. In October 2025, a Net4People post noted that the Geedge and MESA leak contains a presentation that discusses this paper’s peer review.

The Geedge Networks leak

In September 2025, more than 500 GB of internal files leaked from Geedge Networks and the MESA Lab. GFW Report calls them “a core technical force behind the GFW”. The documents show Geedge working for governments in Xinjiang, Jiangsu and Fujian, and exporting its technology to countries including Myanmar, Pakistan, Ethiopia and Kazakhstan.

• OpenVPN by name. InterSecLab’s report on the leak, The Internet Coup, says Geedge’s TSG system uses deep packet inspection (DPI), which looks inside traffic, “to comprehensively identify protocols associated with Virtual Private Networks (VPNs) and circumvention tools, such as OpenVPN and WireGuard”. It adds that TSG hardware “can also identify popular VPN protocols like IPSec, OpenVPN and WireGuard”, and that evidence from the leak suggests Geedge keeps paid accounts with popular VPN providers to analyze and block their apps.
• A rule that uses it. In September 2025, a Net4People user described a leaked rule that flags a “TunnelBear VPN Connection” when a client contacts TunnelBear’s domains and then, within a minute, starts traffic identified as WireGuard, OpenVPN or the key exchange that IPsec VPNs use.
• A support ticket. A leaked Geedge ticket from March 31, 2024, posted on Net4People in October 2025, says the company’s detector correctly identified OpenVPN and WireGuard in sample captures. It put a deployment’s failure to log those sessions down to setup problems, including a third-party inspection engine that wasn’t authorized and changed app IDs, and said the OpenVPN cause needed more investigation. The ticket doesn’t name the site.

None of this shows what the national Great Firewall does with OpenVPN today. It shows that Geedge built and sold systems that identify it.

Forum reports from China

• July 2021. A Net4People user said an OpenVPN connection didn’t let their wife in mainland China use Signal, though it was enough to download a Shadowsocks app. They called the OpenVPN “flaky” and said Shadowsocks, on their server in Hong Kong, worked.
• May 2023. In a thread about areas of China that filtered TLS connections by an allowlist of site names, a commenter wrote that “you can also get away with a slightly obfuscated OpenVPN in Quanzhou”.
• February 2024. After one operator reported hundreds of server IP addresses banned, a commenter said their own servers weren’t seeing it. In their experience, crackdowns before political meetings hit servers with “easily detected VPN protocols on your servers. E.g. PPTP, OpenVPN, IKEv2, Wireguard”.

Timeline

Date	What was reported	Source
Apr 2013	An XOR “scramble” patch for OpenVPN is proposed to avoid detection by firewalls such as China’s; OpenVPN’s developers don’t accept it	Tunnelblick
Jul 2021	A user says OpenVPN is “flaky” in mainland China, while Shadowsocks works	Net4People
Aug 13 to 20, 2021	A detector run on a Michigan network identifies most OpenVPN connections and 34 of 41 obfuscated setups	USENIX Security 2022 paper
Nov 6, 2021	China starts blocking fully encrypted traffic; the study doesn’t mention OpenVPN	USENIX Security 2023 paper
May 28, 2023	A commenter says a slightly obfuscated OpenVPN gets through in Quanzhou	Net4People
Aug 7, 2023	OpenVPN and WireGuard blocking reported in Russia, not China	Net4People
Feb 20, 2024	An operator says crackdowns hit servers with easily detected protocols, OpenVPN among them	Net4People
Mar 31, 2024	A Geedge ticket says its detector identifies OpenVPN in sample captures	Net4People
May 2024	Chinese Academy of Sciences researchers publish a VPN-server finder that sends OpenVPN probes	ACM Web Conference 2024 paper
Sep 2025	Geedge leak; an analysis says its system identifies OpenVPN	GFW Report, InterSecLab
May 12, 2026	NordVPN starts moving its Obfuscated servers from OpenVPN to NordWhisper	NordVPN
Jul 2026	Reddit users say OpenVPN is blocked; a NordVPN user in China loses the OpenVPN obfuscated servers	See below
Sep 29, 2026	Astrill says firewalls can fingerprint how OpenVPN connections start	Astrill

OpenVPN in China in 2025 and 2026

The 2025 and 2026 sources we found are leaked documents, provider pages, forum posts and user reports. None is a measurement of OpenVPN in China, and they don’t all agree.

• March 2025. On r/OpenVPN, users split over whether an OpenVPN server at home in Australia, on non-standard ports, would work from China. Two said the same setup had worked for them; one said “No.”
• September 2025. The Geedge leak, above. The same month, an account that sells routers posted on r/dumbclub that “OpenVPN without obfuscation is definitely blocked”, even to a home connection, while in its experience WireGuard and IKEv2 to home servers worked.
• May 2026. NordVPN began moving its Obfuscated servers from OpenVPN to NordWhisper. It said “OpenVPN-based obfuscation could be slower and was limited to a smaller set of servers”.
• July 2026. On r/selfhosted, one user wrote that “OpenVPN protocols are all blocked”, and another said OpenVPN didn’t work on their trip about two years earlier. On r/nordvpn, a user in China said OpenVPN (TCP) to NordVPN’s Obfuscated servers had worked for four months, until the switch to NordWhisper.
• August 2026. NordVPN’s guide for restrictive countries, edited August 10, still suggests switching to OpenVPN (TCP), “which is more resilient against blocks than UDP”, but says it has “different steps to follow if you are connecting from China”. That month, a Surfshark user in China said switching from Automatic to OpenVPN or WireGuard “makes it even worse”.
• September 2026. Astrill’s guide for restrictive networks, published September 29, says “Protocols like OpenVPN and IPSec open connections in distinctive ways that DPI systems can fingerprint.” It recommends its StealthVPN protocol instead.
• October 2026. Surfshark’s China page, updated October 2, recommends a manual WireGuard connection and doesn’t mention OpenVPN.

What Reddit says about OpenVPN in China

Reddit users mostly say plain OpenVPN is blocked in China, with a few exceptions. These are single users’ experiences, not tests:

• How can someone download OpenVPN on an iPhone in China? (r/OpenVPN, February 22, 2024). The poster said “the app store in China does not have OpenVPN”. One reply said the connection probably won’t start “because GFW will easily recognize openvpn footprints”.
• Need to use OpenVPN and Cisco for work, which appear to be blocked (r/chinalife, September 9, 2024). One user said their personal OpenVPN server on a US VPS was “rarely blocked” after they changed the default port, but that “port 443 tends to be blocked after a few months”. Another wrote that Astrill uses OpenVPN “(it works)” and NordVPN uses it too “(which doesnt)”.
• Work OpenVPN issues (r/chinalife, December 15, 2024). A user said the OpenVPN they needed for a UK job seemed blocked, although a friend had logged in a month earlier. A reply said: “OpenVPN protocols are blocked by the GFW.”
• OpenVPN + China travel (r/OpenVPN, March 23, 2025). The poster planned to use an OpenVPN server at home in Australia on non-standard ports. One reply said the same setup worked “just fine” on a visit a year earlier. Another said: “Yes, it works. I’m in China and have used this method for several years.” A third said no and suggested a different type of proxy.
• Bypass the GFW with standard VPN protocols (r/dumbclub, September 23, 2025). A router seller wrote that standard protocols “usually don’t work” from data center servers but work from home connections, and that “OpenVPN without obfuscation is blocked even when you use residential IP”. One reply said it had heard such setups work only for a little while before the IP is blocked, and another user called that “exactly my experience with openvpn and wireguard”.
• Going to China, could I use my home PC or server as a VPN? (r/selfhosted, July 5, 2026). A user who said they had lived in China for almost a decade wrote: “OpenVPN protocols are all blocked.” Another set up WireGuard, OpenVPN and Shadowsocks for a trip about two years earlier and said “OpenVPN did not work”. A third said they had moved from OpenVPN to Shadowsocks, then to VLESS and VLESS REALITY, “as the GFW upgraded”.
• China and Obfuscated servers (r/nordvpn, July 21, 2026). A user in China said NordVPN with OpenVPN (TCP) had worked for four months without major issues, until the Windows app moved the Obfuscated servers to NordWhisper. On July 23, an account named NordVPN_ProductTM replied that it had tested connections through the Obfuscated servers and couldn’t reproduce the problem. On August 4, another user in China said nothing connected, whatever protocol they tried.
• Connection issues from China (r/surfshark, August 10, 2026). A user said switching Surfshark from Automatic to OpenVPN or WireGuard made their disconnections worse.

If you’d rather not run your own server, a roaming eSIM or a commercial VPN is simpler; see which VPN works in China now.

OpenVPN obfuscation

OpenVPN obfuscation means disguising OpenVPN traffic so a firewall can’t tell what it is, and OpenVPN itself leaves most of that to separate tools. The 2022 study says OpenVPN’s core developers prefer that obfuscation stay a separate project. OpenVPN’s wiki says obfuscation is useful “if your ISP is blocking OpenVPN for some reason” and describes static keys and obfsproxy, a Tor project tool.

The disguises in use fall into three groups:

Method	What its own sources say	What the 2022 study found
XOR “scramble” patch, which scrambles each packet before it is sent	Proposed in April 2013 to avoid detection “by monitoring or censoring mechanisms such as the Great Firewall of China”. OpenVPN’s developers didn’t accept it, but Tunnelblick, a macOS OpenVPN app, includes it	Most obfuscated services it tried resembled OpenVPN with this patch, which it called “easily fingerprintable”: each opcode is always scrambled to the same value
OpenVPN inside another tunnel	OpenVPN’s wiki describes obfsproxy. Providers also used stunnel, SSH, Shadowsocks and V2Ray	Most tunnels added no random padding, so the same-size acknowledgments still showed. Setups using obfs4, V2Ray or padded proprietary protocols got past the study’s filter
A provider’s own protocol	Astrill’s StealthVPN is “inspired by OpenVPN” with “additional obfuscation”. Surfshark says its obfuscation uses “a modified version of the OpenVPN protocol”	See the table below

The study found another weakness: most providers ran their obfuscated servers next to plain OpenVPN servers. For 34 of the 41 obfuscated setups, it found a plain OpenVPN server in the same small block of addresses, leaving the obfuscated servers “guilty by association”.

For the four VPNs we cover, the study’s appendix gives these results from August 2021. “Flagged” means the passive filter marked the connection as OpenVPN; “confirmed” means the follow-up probes confirmed the server. Where marked “inferred”, the provider didn’t say which technique it used and the researchers judged from packet captures.

VPN, August 2021	Obfuscated setup, as the researchers labeled it	Connections flagged	Connections confirmed
Astrill, TCP	Proprietary	47 of 50	9 of 50
Astrill, UDP	Proprietary or XOR (inferred)	50 of 50	0 of 50
ExpressVPN, TCP and UDP	XOR (inferred)	20 of 20	16 of 20
NordVPN, TCP and UDP	XOR (inferred)	50 of 50	50 of 50
Surfshark, TCP	Proprietary or XOR (inferred)	50 of 50	50 of 50
Surfshark, UDP	Proprietary or XOR (inferred)	50 of 50	45 of 50

These results are five years old and from a US network, and providers have changed their setups since. NordVPN’s Obfuscated servers no longer use OpenVPN at all. Whether any obfuscated OpenVPN works in China now is not confirmed. For setup, follow the official docs: OpenVPN’s wiki page on traffic obfuscation and your provider’s help pages.

Which VPNs for China use OpenVPN?

All four VPNs we cover offer OpenVPN or a protocol built on it, according to their own pages, but none puts plain OpenVPN first for China.

VPN	OpenVPN	What its own pages say for China
Astrill	Plain OpenVPN, which works with third-party apps, plus StealthVPN, its own protocol “inspired by OpenVPN” with extra obfuscation, in Astrill’s apps only	Its protocols page says OpenVPN “is often blocked in China”. Its September 2026 guide for heavily restricted countries says to switch to StealthVPN first if you are on a standard protocol. Its iPhone app lets you pick only UDP or TCP
ExpressVPN	OpenVPN, alongside WireGuard and its own Lightway. Its features page says it “uses automatic obfuscation on supported platforms”, without naming protocols	Its China page, updated February 4, 2026, lists OpenVPN fifth of five protocols to try on Windows, Mac, iPhone and Linux. The Android list doesn’t include it
NordVPN	OpenVPN over TCP or UDP, which it recommends if you want “the most stable NordVPN protocol”. Its Obfuscated servers used OpenVPN until it began moving them to NordWhisper in May 2026	Its China pages don’t mention OpenVPN. They say the Android app is “fully blocked” and give manual IKEv2/IPsec steps; on Windows, they say its configurations for manual connections and apps “have recently been blocked”. Its general guide for restrictive countries suggests OpenVPN (TCP), but says China has different steps
Surfshark	OpenVPN over UDP or TCP in its Android, macOS, Windows, iOS and Linux apps. “While using this protocol on Surfshark, you are using obfuscated servers”	Its China page, updated October 2, 2026, recommends a manual WireGuard connection and doesn’t mention OpenVPN. Its obfuscated-servers page says obfuscated servers alone “can’t guarantee that your VPN provider will work in China”

Our NordVPN manual setup guide covers NordVPN’s IKEv2 steps, and our WireGuard in China guide covers Surfshark’s WireGuard advice.

Does OpenVPN Connect work in China?

OpenVPN Connect works in China only if the server and setup it connects to get past the firewall, and plain OpenVPN is often blocked. OpenVPN Inc. calls it its “official client application”: you import a profile from your company or from “some other OpenVPN compatible service”. Its page doesn’t mention any obfuscation feature.

• Getting the app. OpenVPN Connect is on Apple’s US and Hong Kong App Stores, but Apple’s store lookup for China returned no result on October 19, 2026. A Reddit user wrote in February 2024 that “the app store in China does not have OpenVPN”. GreatFire listed openvpn.net as blocked in mainland China when it last checked, on March 27, 2026. Install it before you travel; see how to get a VPN in China.
• Work VPNs. OpenVPN Inc. sells Access Server and CloudConnexa to businesses, and OpenVPN Connect is the app their staff use with them. In December 2024, a user in China said the OpenVPN connection for their UK job seemed blocked. Ask your IT team before you go, and see our guide to corporate VPNs in China.

OpenVPN server for China

An OpenVPN server for China runs outside the mainland, and the user reports we found don’t agree on which servers last. No research we found compares them.

• Home or data center. A router seller said in September 2025 that standard protocols usually don’t work from data center servers but do from home, yet plain OpenVPN is blocked “even when you use residential IP”. In 2024, a user said their OpenVPN server on a US VPS was “rarely blocked” on a non-default port.
• Silent servers aren’t hidden. The tls-auth and tls-crypt options keep a server from answering strangers, but the 2022 study still identified such servers by how they closed connections. The 2024 Chinese study sent OpenVPN probes to standard ports.
• Routes and latency. In our ping measurements from 29 cities on October 13, 2026, the Chinese carrier mattered as much as the distance. See ping to China for the results, and our guide to CN2 GIA, China Telecom’s premium route.
• Host rules. DMIT’s acceptable use policy bans using its servers “to build VPN tunnel(Include, but are not limited to, L2TP, openvpn, PPTP, IPSec, Cisco Anyconnect) to China”. Our CN2 GIA VPS comparison lists other hosts’ rules.
• Setup. Use OpenVPN’s official community how-to and downloads pages.

Before you run a server for yourself or share one with others, read what the law says about VPNs in China.