Introduction

The most common question about internet access in China is not whether you need a VPN —it is how to get one working before you land. The Great Firewall of China blocks Google, Gmail, WhatsApp, Instagram, Facebook, X (Twitter), YouTube, Telegram, and hundreds of other websites and services that travelers rely on daily. Without a properly configured VPN, your smartphone and laptop become significantly less useful the moment your plane touches down in Beijing, Shanghai, or Guangzhou.

This guide covers the practical side of using a VPN in China in 2026. It does not debate whether you need one —if you want to use Google Maps, check Gmail, post to Instagram, or message on WhatsApp while in China, you do. Instead, it walks through what you need to do before you leave, how to set up each device, which protocols bypass the firewall most reliably, and how to fix connection issues when they happen.

Last reviewed: July 20, 2026. VPN enforcement and firewall technology change over time. What works today may not work tomorrow. Always install a backup option.

Before You Leave: The Golden Rule

The single most important rule of using a VPN in China is this: install and test everything before you go. You cannot reliably download a VPN app once you are inside China. The Chinese app store versions of major platforms do not carry VPN software, and the international app stores are blocked unless you already have a working connection.

Here is your pre-departure checklist:

  • Choose and subscribe to at least one premium VPN provider that explicitly supports China usage
  • Choose and subscribe to a second provider as backup
  • Install the VPN app on every device you plan to use (phone, tablet, laptop)
  • Log in and test the connection on your home network
  • Verify that the VPN works with the apps you rely on (Gmail, Google Maps, WhatsApp, Instagram)
  • Download the VPN provider’s configuration files or OpenVPN profiles as a manual backup
  • Install a Shadowsocks client on your devices as a third-layer backup (if you have access to a Shadowsocks server)
  • Download offline maps of your destination cities in Google Maps or Maps.me
  • Save screenshots of your VPN account credentials and setup instructions

Spend 30 minutes on this checklist before your flight. It will save you hours of frustration at a hotel lobby desk.

Choosing a VPN Provider for China

Not all VPNs work in China. The Great Firewall actively probes and blocks known VPN server IP addresses and protocol fingerprints. Free VPNs almost never work. Budget VPNs that promise China access often stop working within weeks.

When evaluating a VPN for China travel, look for these features:

FeatureWhy It Matters
Obfuscation / Stealth modeMasks VPN traffic as regular HTTPS, making it harder for the firewall to detect
OpenVPN TCP 443This protocol on this port looks identical to normal web traffic
WireGuard supportFaster than OpenVPN, though sometimes detected and blocked
Shadowsocks supportA lightweight proxy protocol that is difficult to detect
Servers in Hong Kong or JapanClosest external servers to mainland China for better speeds
Kill switchBlocks all internet traffic if the VPN disconnects unexpectedly
Multiple simultaneous connectionsUsually 5 to 8, enough to cover phone, tablet, and laptop
30-day money-back guaranteeLets you test whether it works for your specific trip

Providers that are known to have maintained China-compatible servers over time include ExpressVPN, NordVPN, Surfshark, and Astrill, among others. The landscape changes frequently, so check recent traveler reports from the last 30 days before subscribing.

Avoid any provider that claims a “free forever” plan. Free VPNs in China are either non-functional, dangerously insecure, or both.

Setting Up Your Phone (iOS / Android)

On iPhone

  1. Before you leave: Download your VPN provider’s app from the App Store while on your home country’s App Store account. The Chinese App Store does not carry the same apps.
  2. Create and test: Open the app, log in with your account, and connect to a server outside China. Verify that Gmail, Google Maps, and WhatsApp load correctly.
  3. Enable the on-demand feature: Most VPN apps have a setting to connect automatically when joining untrusted networks. Enable this for airport and hotel WiFi.
  4. Manual IKEv2 setup (backup): Some VPN providers offer an IKEv2 configuration that can be installed manually in Settings →VPN. This works even if the app is blocked. Set this up before you leave.

On Android

  1. Before you leave: Download your VPN app from the Google Play Store. Also download the APK file as a backup, saved to your phone’s local storage or a cloud drive.
  2. Create and test: Same as iOS —log in and verify functionality on your home network.
  3. Enable always-on VPN: In Android Settings →Network & Internet →VPN, enable the always-on VPN feature for your provider. This prevents leaks.
  4. Download a backup client: Install OpenVPN Connect or WireGuard from the Play Store and download your provider’s configuration files.

On Laptop (Windows / Mac)

  1. Install the desktop client: Download your VPN’s Windows or Mac app from the provider’s website while on your home network.
  2. Configure the kill switch: Enable the kill switch in the VPN settings before you leave. This is critical —without it, if the VPN drops, your real IP is exposed and all traffic stops routing through the tunnel.
  3. Download OpenVPN configuration files: Most providers offer downloadable .ovpn files for manual OpenVPN setup. Download these and save them locally and to a USB drive or cloud storage as backup.
  4. Test the connection: Connect to a server outside China and verify that your traffic is routed correctly by checking your IP address at whatismyip.com.

What to Do When You Arrive in China

  1. Activate your Chinese data connection first. Whether you are using an eSIM, a physical SIM from China Mobile or China Unicom, or a pocket WiFi, get connected to the local network.
  2. Connect your VPN. Open the app and connect. If the automatic protocol does not work, switch to OpenVPN TCP 443 manually.
  3. If the default server does not connect, try servers in Hong Kong, Japan, or Singapore. These regions generally have the best connectivity to mainland China.
  4. If your primary VPN does not connect at all, switch to your backup provider. If the backup also fails, try manual OpenVPN using the configuration files you downloaded before your trip.
  5. Once connected, confirm that Google, Gmail, WhatsApp, and any other essential apps are working.

Troubleshooting: When Your VPN Does Not Work

VPN connectivity in China is not guaranteed. Here is a troubleshooting sequence:

Connection Refused or Timeout

  • Switch to OpenVPN TCP port 443 protocol
  • Change server location (try Hong Kong, Japan, Singapore in that order)
  • Enable obfuscation / stealth mode
  • Try connecting over mobile data instead of WiFi (or vice versa)
  • Restart the app and try again

VPN Connects But Websites Do Not Load

  • DNS leakage —switch to your VPN provider’s DNS or use a public DNS like 1.1.1.1 or 8.8.8.8
  • Try a different server in the same region
  • Clear your browser DNS cache
  • Disable IPv6 on your device (some VPNs do not route IPv6 traffic properly)

VPN Was Working Yesterday But Stopped Today

  • The firewall may have detected and blocked that specific server IP
  • Switch to a different server —most providers update their China-compatible server IPs regularly
  • Try a different protocol (WireGuard to OpenVPN, or vice versa)
  • Update your VPN app —providers push updates to work around new blocks

Nothing Works

If both VPNs and all protocols fail, fall back to:

  • Shadowsocks, if you set it up before your trip
  • Astrill, which operates its own protocol that is harder to block
  • Your hotel’s business center —some hotels have international connections that bypass the firewall
  • Airport lounges —some international departure lounges have unfiltered WiFi
  • Roaming data —if your home carrier includes China in a roaming plan, your traffic may route through your home country and bypass the firewall partially

VPN vs Shadowsocks vs Smart DNS: What Is the Difference?

MethodHow It WorksBest For
VPNEncrypts all device traffic and routes it through an external serverFull internet access for all apps and websites
ShadowsocksA lightweight encrypted proxy that routes specific trafficBypassing the firewall for specific apps with minimal speed loss
Smart DNSOnly redirects DNS queries for blocked domains without full encryptionUnblocking streaming services (Netflix, Hulu) without slowing down overall connection

For most travelers, a VPN is the right choice. Shadowsocks is an excellent backup because it is harder to detect. Smart DNS alone is not sufficient for general browsing in China.

Summary

Using a VPN in China requires preparation before you leave. Install at least two VPN providers on all your devices while on your home network, test them, and download configuration files as backup. OpenVPN TCP 443 and WireGuard are the most reliable protocols. Expect some connectivity issues and have a troubleshooting plan ready. The effort of setting up a VPN before your trip is minimal compared to the frustration of arriving in China without access to Google Maps, WhatsApp, or Gmail.

Your pre-flight checklist in three sentences: subscribe to a premium VPN that explicitly supports China, install it on every device, and test it before you go. Then download a second VPN and set it up as backup. This 30-minute investment will save you hours of headache on the ground.