WireGuard in China: Is It Blocked?

Does WireGuard work in China?

WireGuard in China works for some people in 2026 and gets blocked for others, and we found no research measurement that settles it. We haven’t tried WireGuard in China. This page reports what researchers, providers and users say, with dates.

• Research. No study we found measures WireGuard inside China. Studies of the firewall’s other systems found that its 2021 blocking of fully encrypted traffic covered only TCP, the connection type most websites use, and that its QUIC blocking, in place since 2024, reads UDP traffic. WireGuard runs over UDP.
• Leaked documents. A September 2025 analysis of documents leaked from Geedge Networks says its filtering system identifies VPN protocols including WireGuard. Geedge works for Chinese provinces and for other countries. Whether the national firewall uses the same rules is not confirmed.
• 2025 and 2026 reports. Users disagree. In October 2026, a traveler said WireGuard to their home router worked surprisingly well during a two-week trip, while another user said “literally 99 out of 100” of Mullvad’s WireGuard servers won’t work in China. Others say WireGuard works for a day or two, then slows or stops.
• Providers. Surfshark recommends a manual WireGuard connection from China. NordVPN and Astrill point China users to other protocols, and ExpressVPN lists WireGuard fourth of the five protocols to try.

To compare WireGuard with other protocols, see our guide to the best VPN protocol for China.

What WireGuard is

WireGuard is a free, open-source VPN protocol that its project calls “an extremely simple yet fast and modern VPN”. It “securely encapsulates IP packets over UDP”, and two devices connect by exchanging public keys, short codes that identify each side. It was first built into the Linux kernel and now runs on Windows, macOS, BSD, iOS and Android.

Is WireGuard blocked in China?

Not everywhere, going by user reports, but many people say plain WireGuard connections get blocked or slowed, often within hours or days. No research we found has measured it.

• It varies by place. In December 2025, a Net4People user wrote that WireGuard “works in some places but not others” in China. In February 2026, another wrote, in a comment translated from Chinese, that traffic identification systems “in some regions have poor UDP inspection capabilities”.
• How it shows up. In the reports we found, blocking looked like a server port, the numbered entry point WireGuard listens on, that stopped answering, handshakes that never completed, or a connection throttled “to where it is unusable” (Reddit, October 2025 to October 2026).
• Other countries. Net4People users have reported WireGuard blocking elsewhere: in Iran in October 2022, in Russia in August 2023 and in Saudi Arabia in December 2023.

How the Great Firewall detects WireGuard

No published study shows how the Great Firewall detects WireGuard. The sources show three things: WireGuard is easy to recognize by design, the firewall has read UDP traffic since 2024 to block QUIC, and leaked documents describe filtering systems that identify WireGuard.

Why WireGuard’s handshake is easy to recognize

WireGuard’s own documentation explains it. “WireGuard does not focus on obfuscation,” its page of known limitations says. “Obfuscation, rather, should happen at a layer above WireGuard.”

• Fixed headers. Every WireGuard message starts with a one-byte message type, followed by three bytes of zeros. Type 1 opens the handshake, type 2 answers it, type 3 is a cookie reply and type 4 carries data.
• Fixed sizes. The handshake messages have fixed fields. AmneziaWG’s docs, which describe a WireGuard fork built to avoid detection, give the sizes: the first handshake message is exactly 148 bytes, the reply 92 bytes and a cookie reply 64 bytes. They say WireGuard’s “fixed packet headers and predictable packet sizes create an easily recognizable signature”.
• UDP only. “All packets are sent over UDP,” the protocol page says. WireGuard “explicitly does not support tunneling over TCP” and leaves that to other tools.
• Silent to strangers. A WireGuard server sends nothing back to packets it can’t authenticate. The whitepaper says this makes WireGuard “invisible to illegitimate peers and network scanners”.

Providers that sell their own protocols say the same. ExpressVPN wrote in November 2021 that WireGuard’s stance on obfuscation means “it’s easy for censorship platforms or corporate firewalls to detect and block WireGuard”. Proton wrote in October 2022 that traditional VPN protocols, WireGuard among them, “are relatively easy to recognize on a network”.

For comparison, in the 2020 Shadowsocks study, the firewall sent probes to suspected servers “to confirm whether the server really is Shadowsocks”, and the researchers suspected it judged them by how they reacted (GFW Report, IMC 2020). We found no research on whether the firewall probes WireGuard servers.

What research on the firewall shows

• 2021: TCP only. From November 6, 2021, the firewall blocked fully encrypted traffic, such as Shadowsocks, in real time. The researchers found that “UDP traffic is not affected. The new censorship system is limited to TCP.” They called switching to UDP “merely a stopgap measure, as the censor can enable their censorship for UDP” (GFW Report, USENIX Security 2023, published April 2023). The paper doesn’t mention WireGuard.
• 2024: reading UDP. Since April 7, 2024, the firewall has blocked QUIC connections to some domains by inspecting the first packet of each UDP flow. When it finds a blocked domain, it drops the client’s packets for three minutes. The researchers called it “the first known instance of the GFW implementing residual blocking via packet dropping for a UDP-based protocol” (GFW Report, USENIX Security 2025, published July 2025). That system looks for QUIC, not WireGuard.

The Geedge Networks leak

In September 2025, more than 500 GB of internal files leaked from Geedge Networks and the MESA Lab. GFW Report calls them “a core technical force behind the GFW”. The documents show Geedge working for governments in Xinjiang, Jiangsu and Fujian, and exporting its technology to countries including Myanmar, Pakistan, Ethiopia and Kazakhstan.

• WireGuard by name. InterSecLab’s report on the leak, The Internet Coup, says Geedge’s TSG system uses deep packet inspection, which looks inside traffic, “to comprehensively identify protocols associated with Virtual Private Networks (VPNs) and circumvention tools, such as OpenVPN and WireGuard”. It adds that TSG hardware “can also identify popular VPN protocols like IPSec, OpenVPN and WireGuard”.
• A rule that uses it. In September 2025, a Net4People user described a leaked rule that flags a “TunnelBear VPN Connection” when a client contacts TunnelBear’s domains and then, within a minute, starts traffic identified as WireGuard, OpenVPN or the key exchange that IPsec VPNs use.
• A modified WireGuard. Leaked documents on Cloudflare’s WARP VPN app, posted on Net4People in October 2025, say WARP “uses a modified WireGuard protocol” that passive traffic identification couldn’t recognize. They describe a detector built from fixed bytes in WARP’s UDP packets. The user who posted them said they show how Geedge blocked WARP in Ethiopia and Myanmar.

None of this shows what the national Great Firewall does with WireGuard. It shows that Geedge built and sold systems that identify it.

Forum posts about China

• February 2024. After one operator reported hundreds of server IP addresses banned, a Net4People commenter said their own servers weren’t seeing it. In their experience, crackdowns before political meetings hit servers running “easily detected VPN protocols”, and they named “PPTP, OpenVPN, IKEv2, Wireguard”.
• December 2024. In a thread on best practice for China, a user said that when they played a game over UDP, “any server I used got blocked within an hour or two”. They didn’t say WireGuard was involved, and they called WireGuard wrapped in udp2raw, one of the TCP tools WireGuard’s docs name, their most stable setup for gaming.
• September 2025. A user preparing for a year in China wrote that, based on what they had read, WireGuard and several other protocols appeared “either fully obsolete or irreparably flawed” for their purposes.
• December 2025 and February 2026. In the Cisco AnyConnect thread quoted above, the user who said WireGuard works only in some places also warned that “being allowed doesn’t mean you’re not being watched”. Another wrote: “if WireGuard works in your area, Cisco Anyconnect should also be accessible.”

Timeline

Date	What was reported	Source
Nov 6, 2021	Real-time blocking of fully encrypted traffic begins; UDP traffic is not affected	USENIX Security 2023 paper
Oct 2022	WireGuard reported blocked in Iran, not China	Net4People
Aug 2023	OpenVPN and WireGuard blocking reported in Russia, not China	Net4People
Feb 20, 2024	A commenter says crackdowns hit servers with easily detected protocols, WireGuard among them	Net4People
Apr 7, 2024	The firewall starts blocking QUIC by inspecting UDP traffic	USENIX Security 2025 paper
Sep 2025	Geedge leak; an analysis says its system identifies WireGuard	GFW Report, InterSecLab
Oct 2025	Leaked Geedge documents on detecting WARP, a modified WireGuard, posted	Net4People
Dec 25, 2025	A user says WireGuard works in some places in China but not others	Net4People
Jun 11, 2026	An unsourced Reddit post says standard WireGuard fails “near-100%”	Reddit
Oct 2026	Reports conflict: a home router works during a two-week trip; most Mullvad WireGuard servers fail for another user	See below

WireGuard in China in 2025 and 2026

The 2025 and 2026 sources we found are leaked documents, provider pages, forum posts and user reports. None is a measurement of WireGuard in China, and they disagree.

• September 2025. The Geedge leak, above.
• November 2025. Mullvad added Lightweight WireGuard Obfuscation. It said its app “should become more usable in countries and networks where WireGuard traffic and our other obfuscation methods are otherwise blocked”. It didn’t name China.
• April 2026. Mullvad’s guide for restrictive locations says “the great firewall of China is blocking all Mullvad servers in Asia” and suggests US servers with its obfuscation settings.
• June 2026. A post on r/RecommandedVPN said that after an April 2026 crackdown, “Shadowsocks, V2Ray, standard WireGuard: all fail near-100%”. It cited no sources, and a reply said the post “only seems half-true”. Not confirmed.
• June 2026. A user who had used AmneziaVPN’s WireGuard in China for about a month said it suddenly showed “Connected” but loaded no Western websites, on two servers with different IP addresses. Replies suggested settings problems, so the cause isn’t clear.
• October 2026. Surfshark’s China page, updated October 2, still recommends a manual WireGuard connection. User reports that month conflict; see the next section.

What Reddit says about WireGuard in China

Reddit users in 2025 and 2026 disagree about WireGuard in China. These are single users’ experiences, not tests:

• Will wireguard work in Shanghai, China in 2025? (r/WireGuard, started October 18, 2025). The first reply said WireGuard “is considered blocked”: it may work for a few minutes before it is blocked or throttled “to where it is unusable”. Another user said they had used WireGuard in Shanghai “for past 2 years and it works fine”, with their server on a residential IP address. A third said the WireGuard port on their US server became unreachable “after a while”, but not on a server in China. On October 6, 2026, a reply said their WireGuard “wouldn’t get any handshakes” for about a month.
• Paid VPN necessary if you have already set up a WireGuard VPN connection to your router at home? (r/chinatravel, November 20, 2025). One user in China said they had no problem using WireGuard in Hong Kong, Chongqing, Chengdu, Xi’an and Beijing. Others replied that WireGuard to a home router “will get blocked pretty quickly depending on how often you use it and where you are in China”, and that it “only works for a couple of days, then it slows to a crawl”.
• WG VPN in China 2026 (r/WireGuard, June 29, 2026): the AmneziaVPN report above.
• Any way to improve the experience on HarmonyOS 6 (r/WireGuard, July 29, 2026). A user running WireGuard to a home server in the Netherlands “purely for in China use” said it “works near perfect on other devices”, but that “browsing, whatsapp downloads and browser downloads are slow”.
• VPNs in China, what worked for me (r/chinatravel, October 1, 2026). A traveler in Beijing, Shenzhen and Jinan said WireGuard to their home Fritzbox router worked surprisingly well. They guessed it was too unimportant for the firewall to bother with. Astrill worked for them and Proton didn’t.
• Vpn in china mainland (r/VPNforFreedom, October 10, 2026). A user said Astrill, VLESS on Xray and WireGuard all worked badly for their partner in China, especially from 4 pm to 1 am.
• Wireguard Configuration File (r/chinalife, October 15, 2026). A user said WireGuard files for Astrill’s “China Supercharged” servers didn’t work on their GL.iNet router. A reply said that with WireGuard files from Mullvad, “literally 99 out of 100 servers won’t work in China”.
• China ran its most coordinated VPN crackdown in years (r/RecommandedVPN, June 11, 2026): the unsourced claim above.

If you’d rather not run your own server, a roaming eSIM or a commercial VPN is simpler; see which VPN works in China now.

WireGuard obfuscation in China

WireGuard obfuscation means wrapping or reshaping WireGuard traffic so it looks like something else, and we found no published measurement of any WireGuard obfuscation method inside China. The WireGuard project leaves this to other tools. It says obfuscation “should happen at a layer above WireGuard”, and names udptunnel and udp2raw as projects that can turn its UDP packets into TCP.

Providers and projects that offer disguised WireGuard describe their methods this way:

Method	Who offers it	What its own docs say
LWO (Lightweight WireGuard Obfuscation)	Mullvad, since November 2025	Works by “scrambling the header of each WireGuard packet, making them harder to fingerprint as VPN traffic”, on a random port
QUIC	Mullvad, since September 2025	Uses UDP port 443 and is “made to make your VPN traffic look like normal web traffic”
Shadowsocks and UDP-over-TCP	Mullvad	Two older settings in the same menu. See our Shadowsocks in China guide
Stealth	Proton VPN, since October 2022	Proton’s “custom WireGuard-based VPN protocol”, running “over an obfuscated TLS tunnel over TCP”. TLS is the encryption HTTPS websites use
AmneziaWG	Amnezia, as a fork of WireGuard	Randomizes WireGuard’s headers and packet sizes and can send decoy packets before the handshake. Version 3.1 was a response to “widespread blocking in Russia in June and July 2026”

Mullvad’s guide adds that its obfuscation settings “are not available if you use WireGuard outside of the Mullvad app”. Its plain WireGuard port setting “does not use any obfuscation, so it’s not effective against packet inspection firewalls”.

What users report from China is thin:

• Mullvad. Its own guide says the firewall blocks all its servers in Asia. The October 2026 report of “99 out of 100” failing servers involved WireGuard files from Mullvad, and Mullvad says its obfuscation isn’t available outside its app. On October 16, 2026, a user in China said Mullvad connected only after they switched to QUIC.
• AmneziaWG. In October 2025, one Reddit reply said “AmneziaVPN - works very good”, and two days later another said “Amnezia and proton don’t work”. In June 2026, another user’s AmneziaVPN WireGuard connection stopped loading Western sites after a month.
• Proton. In October 2026, a traveler said Proton didn’t work for them during a two-week trip in China, and another user in the same thread said they “had no issues with Proton” when they could get Wi-Fi working. Neither said which protocol they used.

Whether any of these methods works in China now is not confirmed. For setup, follow the official docs: Mullvad’s guide for restrictive locations, Proton’s WireGuard and Stealth page and the AmneziaWG documentation.

Which VPNs for China use WireGuard?

All four VPNs we cover offer WireGuard or a protocol built on it, according to their own pages, but only Surfshark puts it first for China.

VPN	WireGuard	What its own pages say for China
Astrill	WireGuard in its own apps. Its protocol page lists Windows, macOS, Linux, iOS and Android, and its FAQ says WireGuard needs Astrill’s software. Its blog says the iOS app lets you pick only UDP or TCP	Its September 2026 guide for heavily restricted countries points to StealthVPN and OpenWeb. It notes WireGuard “is often set up on UDP port 51820” and that a restrictive firewall can block default ports outright. Its WireGuard page doesn’t mention China
ExpressVPN	Post-quantum WireGuard added on August 6, 2025; ExpressVPN says it added its protections “without modifying the WireGuard protocol itself”. Its default protocol, Lightway, is its own design built on wolfSSL, not on WireGuard	Its China page, updated February 4, 2026, lists WireGuard fourth of five protocols to try on Windows, Mac, iOS and Linux, after Automatic and two Lightway modes. The Android list doesn’t include it
NordVPN	NordLynx, “built around the WireGuard VPN protocol”, is the default in most apps. Manual WireGuard guides added from late September 2026	Its China pages say the apps are fully blocked and give manual IKEv2/IPsec steps, except on Windows, where it says its configurations have been blocked too. They don’t mention NordLynx or WireGuard
Surfshark	WireGuard in its Windows, iOS, Android and macOS apps, plus manual setup	Its China page, updated October 2, 2026, strongly recommends a manual WireGuard connection if the app can’t connect

Only ExpressVPN claims obfuscation that might cover WireGuard: its features page says it “uses automatic obfuscation on supported platforms”, without naming protocols. The other three describe obfuscation as a separate option: Astrill’s StealthVPN and OpenWeb, NordVPN’s NordWhisper and Obfuscated servers, and Surfshark’s obfuscated servers for OpenVPN.

Does Surfshark WireGuard work in China?

Surfshark strongly recommends a manual WireGuard connection from China when its app can’t connect, but user reports are mixed and its current status is not confirmed.

• What Surfshark says. Its China page, updated October 2, 2026, says: “At the moment, we strongly recommend connecting manually using the WireGuard protocol if you can’t connect via the Surfshark app.” It links China guides for Windows, Android, iOS, macOS and Linux. The iOS guide has you import a configuration file from your Surfshark account into the official WireGuard app.
• No obfuscation mentioned. Surfshark’s protocol page says its OpenVPN connections use obfuscated servers. It says nothing about obfuscation for WireGuard.
• What users report. On September 11, 2025, a user in China said they followed the manual WireGuard instructions step by step and it still didn’t work. On August 10, 2026, another said that switching the app from Automatic to OpenVPN or WireGuard made their disconnections even worse.

Surfshark’s guides are on its Connecting from China page. Our Surfshark page has its overall status.

Does NordVPN use WireGuard?

Yes. NordLynx, the default protocol in most NordVPN apps, is “built around the WireGuard VPN protocol” with NordVPN’s “custom double NAT system for added privacy”. NAT is the address sharing that home routers also do.

• Manual WireGuard. From late September 2026, NordVPN’s help center also has guides for connecting through the official WireGuard app with NordVPN service credentials.
• Not a disguise. NordVPN describes NordLynx’s addition as a privacy feature. For restrictive networks, it recommends NordWhisper, and its Obfuscated servers only appear when the protocol is set to Auto or NordWhisper.
• In China. NordVPN says its Android, iOS, macOS and Linux apps are “fully blocked” in China and gives manual IKEv2/IPsec steps. On Windows, it says its server configurations for manual connections and apps “have recently been blocked”. None of its China pages mentions NordLynx.

See our NordVPN page and our guide to NordVPN’s manual setup in China.

WireGuard server for China

A WireGuard server for China runs outside the mainland, and the user reports we found don’t show a clear pattern for which servers last. No research we found compares them.

• Home or data center. Several users who said WireGuard kept working connected to a home router or home server. Others said home connections were blocked “pretty quickly” too. One user said their US server’s WireGuard port became unreachable after a while.
• Inside China. Some users said WireGuard between two points inside mainland China works, and that trouble starts when the connection crosses the border (Reddit, October 2025).
• Routes and latency. In our ping measurements from 29 cities on October 13, 2026, the Chinese carrier mattered as much as the distance. See ping to China for the results, and our guide to CN2 GIA, China Telecom’s premium route.
• Host rules. Our CN2 GIA VPS comparison lists each host’s rules on proxies and VPN tunnels.
• Setup. Use WireGuard’s official installation and quick start pages.

Before you run a server for yourself or share one with others, read what the law says about VPNs in China.