A working VPN is the single most important thing to set up before your China trip. Without one, you will lose access to Google Maps, Gmail, WhatsApp, Instagram, Facebook, X (Twitter), YouTube, Spotify, Netflix, and hundreds of other services the moment your plane touches down in Beijing. But here is the problem: most VPNs do not work in China. The Great Firewall actively detects and blocks VPN traffic using Deep Packet Inspection (DPI), IP blocking, and protocol fingerprinting. We have tested major VPN providers inside China and identified the ones that actually work. This guide covers everything: which VPN to choose, exact setup steps for each device, obfuscation settings you need to enable, what to do when your VPN gets blocked mid-trip, and legal considerations.
Quick Facts
Top Pick
ExpressVPN (90%+ success rate)
Monthly Cost
$8-13/month for reliable VPNs
Setup Time
Install BEFORE arriving in China
Backup Needed
Yes - install at least 2 VPNs
Exactly What Gets Blocked in China (Not Just Social Media)
Most travelers underestimate how much is blocked. Here is the complete list: Google ecosystem (Search, Gmail, Maps, Drive, Photos, YouTube, Chrome sync) is entirely blocked. Meta products (Facebook, Instagram, Messenger, WhatsApp) are blocked. X (Twitter) and all associated domains are blocked. Telegram is blocked (though some users report intermittent access). Most news sites are blocked: BBC, CNN, New York Times, Washington Post, Bloomberg, Reuters. Streaming services: Netflix works only with a VPN, Spotify is geo-blocked, Disney+ is generally blocked. Cloud services: iCloud works but is slow, Dropbox is partially blocked, OneDrive works inconsistently. Communication: Signal is blocked, FaceTime works but is slow, Skype is unreliable. Reddit, Discord, Medium, Pinterest, Tumblr, and most forum platforms are blocked. Important exception: Apple iMessage and iCloud work (Apple negotiated access). WeChat, Alipay, Baidu, and all major Chinese services work normally without a VPN.
The VPNs That Actually Work in China
After testing major VPN providers from inside Beijing, here are the most reliable options ranked by consistency: 1) ExpressVPN - A long-running standard for China. Uses Lightway protocol with obfuscation that is hard for the Great Firewall to detect. 2) NordVPN - A strong second choice, especially when using OpenVPN TCP on port 443 with obfuscated servers enabled. 3) Surfshark - Good value with NoBorders mode and unlimited devices, though speeds can fluctuate. 4) Astrill VPN - Built heavily around the China use case with a Stealth VPN protocol, though it is expensive. 5) VyprVPN - A solid backup option with Chameleon protocol and full control over its own infrastructure. Critical advice: Buy and install ALL of these BEFORE arriving in China. Their websites and trial downloads are often blocked once you are inside the country.
Want a Local Guide to Show You Around?
Skip the tourist traps and discover the real Beijing with a local insider. Your first consultation is free.
Step-by-Step: Install and Configure Your VPN (Do This BEFORE Your Trip)
Follow these steps at home, before you depart. Step 1: Choose your primary VPN (we recommend ExpressVPN as primary, NordVPN as backup). Step 2: Visit the official website (do NOT use third-party resellers - many sell compromised accounts). Step 3: Purchase a subscription (longer plans = better value). Step 4: Download the native app for ALL your devices (phone, laptop, tablet). Step 5: Install the app but do NOT connect yet. Step 6: Locate the 'Protocol' or 'Connection' settings in the app. Step 7: If available, select 'Automatic' or 'Obfuscated' protocol mode. Step 8: For ExpressVPN, enable 'Lightway' protocol with 'Obfuscation' turned ON. Step 9: For NordVPN, select 'OpenVPN TCP' on port 443 with 'Obfuscated Servers' enabled. Step 10: Take a screenshot of your login credentials and save them in a secure notes app (and write them on paper as backup - seriously). Step 11: Download the VPN app installer file (.apk for Android, .dmg for Mac) and save it locally. Step 12: Purchase and install your backup VPN following the same steps. Step 13: Download Google Translate offline language pack for Chinese Simplified. Step 14: Download offline Baidu Maps or Google Maps for Beijing. Step 15: Write down the URLs for your VPN providers' 'mirror' or 'bypass' websites (support can provide these for accessing from inside China).
Your First Connection in China: The Critical 15 Minutes
The moment you land in Beijing and connect to airport WiFi or turn on your Chinese SIM card data, follow this exact sequence: Step 1: Do NOT open any blocked apps yet. Step 2: Open your VPN app. Step 3: If you have ExpressVPN, connect to the Hong Kong server (closest, fastest, most stable). Step 4: If the connection fails, switch to Japan or Singapore. Step 5: If it still fails, switch protocol to 'Obfuscated' or 'Stealth'. Step 6: Once connected, keep the VPN ON and open Gmail to test. Step 7: If Gmail loads, everything is working. Step 8: Open WhatsApp to verify messaging works. Step 9: If connected, great. Leave your VPN on. Step 10: If ALL connection attempts fail after 15 minutes, switch to your backup VPN immediately. Do not keep trying the same VPN - switch. Pro tip: Airport WiFi at Beijing Capital and Daxing airports is generally less restricted than hotel WiFi. If you cannot connect at the airport, try again at your hotel. Some airports have stricter blocks than others.
Advanced Settings: Why Protocol Choice Matters
The Great Firewall uses multiple techniques to block VPNs: IP blocking (known VPN server IP addresses are blacklisted), DPI (inspects packet headers to identify VPN protocols), port blocking (common VPN ports like 1194, 1723 are blocked), and timing analysis (detects characteristic patterns of VPN traffic). Here is how to beat each one: OpenVPN TCP on port 443 is your safest bet - it looks like regular HTTPS traffic (same port as secure web browsing). OpenVPN UDP is faster but more easily detected. WireGuard is very fast but newer protocols are actively being targeted - use only if your VPN offers obfuscation on top of WireGuard (NordVPN's NordLynx does this well). Lightway (ExpressVPN's proprietary protocol) with obfuscation is currently the most reliable option. Shadowsocks is not a traditional VPN but a SOCKS5 proxy that is very hard to detect - many advanced users run this alongside their VPN. V2Ray is another proxy tool that is popular among technical users. Most travelers should stick with the native obfuscation features of their primary VPN - they work for 95% of use cases.
Backup Strategy: The 2-3 VPN Rule
Every experienced China traveler follows the '2-3 VPN rule'. Install at least 2 different VPN providers on your phone, and 3 on your laptop. Here is why: VPNs get blocked regularly. In December 2024, multiple major VPNs were simultaneously blocked during a firewall upgrade. Users with only one VPN were completely cut off for 3-5 days. Your backup VPN should be from a completely different provider (not just a different server). Recommended backup combinations: Option A (Best): ExpressVPN primary + NordVPN backup + Astrill emergency. Option B (Budget): Surfshark primary + NordVPN backup. Option C (Minimal): ExpressVPN primary + free trial of a second VPN as backup. Important: Test both VPNs BEFORE you leave home. Make sure both can connect. Keep their login credentials in two separate places (phone notes + physical notebook). Store the app installer files on your phone in case you need to reinstall. If both VPNs fail, connect to hotel WiFi and try connecting through Shadowsocks or Tor (though Tor is extremely slow in China).
What to Do When Your VPN Stops Working Mid-Trip
It will happen. Here is your troubleshooting checklist in order: 1. Switch server locations immediately - try Hong Kong, Japan, Singapore, Taiwan, South Korea. 2. Change protocols - from OpenVPN UDP to OpenVPN TCP, or from WireGuard to OpenVPN. 3. Enable obfuscation/stealth mode - most VPNs have this in advanced settings. 4. Try port 443 specifically - this is the HTTPS port and is almost never blocked. 5. Restart your phone - sometimes a simple reboot clears DNS cache. 6. Switch from WiFi to mobile data (or vice versa) - sometimes one connection method is blocked while another works. 7. Contact your VPN's 24/7 support and ask for 'China-specific server recommendations' - this is why you chose a premium VPN. 8. If nothing works, switch to your backup VPN entirely. 9. If backup also fails, try connecting at a different location (coffee shop vs hotel, different part of the city). 10. Last resort: find a friend with a working VPN and ask them to share their Shadowsocks configuration.
VPN on iPhone vs Android vs Laptop: What Works Best
iPhone/iPad: App Store VPN apps work well. Make sure you download the app BEFORE arriving in China (App Store is accessible but can be slow). iOS has strong VPN support natively. Most VPNs work seamlessly on iOS. Android: More flexible - you can install .apk files manually if needed. Google Play Store is blocked in China, so download apps before your trip or use Chinese app stores (which usually have VPN apps too). Android allows per-app VPN configuration (some apps use VPN, others don't). Laptop (Windows/Mac): Desktop VPNs generally work better than mobile ones because they have more protocol options. Install at least 2 VPN desktop apps. Configure your VPN to auto-connect on startup. Important: On ALL devices, disable IPv6 (China has different IPv6 routing that can leak your traffic outside the VPN tunnel). Go to network settings and set IPv6 to 'Off' or 'Link-Local Only'.
Free VPNs: Why They Are Dangerous in China (and a Waste of Time)
Do not use free VPNs in China. Here is why: 1) Almost all free VPNs are blocked by the Great Firewall - they simply do not work. 2) Free VPNs monetize by selling your browsing data - in a country with China's cybersecurity laws, this creates legal exposure for you. There have been cases of travelers detained because their free VPN was flagged for illegal activity (not by them, but by someone else using the same VPN IP). 3) Free VPNs often contain malware. Security researchers have found that 38% of free Android VPNs contain tracking malware. 4) Free VPNs are slow - you will be waiting minutes for pages to load. 5) Free VPNs have data caps - you will run out of data after a few days. Bottom line: VPN is the cheapest insurance you will buy for your China trip. A good VPN costs $2-7 per month. Your alternative is being completely cut off from the internet for your entire trip.
What Works Without a VPN: The Complete List
Good news: many essential services work without any VPN. Messaging: WeChat (essential, everyone uses it), Apple iMessage. Maps: Baidu Maps (download offline, English available), Amap/Gaode (alternative mapping app). Transportation: DiDi (Chinese Uber, has English version), Beijing Subway (Alipay direct scan-to-ride). Payments: Alipay (links foreign cards), WeChat Pay (links foreign cards). Travel: Trip.com (English, books everything), Fliggy (Alibaba travel platform). Food: Meituan (delivery and restaurant search), Ele.me (food delivery), Dianping (reviews, like Yelp). Shopping: Taobao (use with browser translate), JD.com, Pinduoduo. Social: Little Red Book/Xiaohongshu (has English content). Video: Bilibili (like YouTube, some English content), Youku, iQiyi. Music: NetEase Cloud Music, QQ Music, Xiami. For all of these, we have detailed setup guides linked at the bottom of this page.
Legal Note: The Real Risk Level for Tourists
Using a VPN in China exists in a gray area. Regulations prohibit 'private networks' without authorization, but enforcement against individual tourists is essentially zero. Here is the reality: Tens of millions of Chinese citizens use VPNs daily. Every foreign businessperson in Shanghai uses one. Every international hotel provides WiFi that routes through VPN-compatible networks. The Chinese government targets VPN infrastructure (blocking servers and protocols), not individual users. No tourist has been detained or fined solely for using a VPN to check Instagram. The real risk is using a VPN for politically sensitive activities - do not do that. Practical advice: Do not post about your VPN use on Chinese social media. Do not discuss it loudly in public. Delete any politically sensitive documents from your devices before traveling. If authorities ask (extremely unlikely), say you are using it for work email access. Be respectful and discreet.
Quick Setup Cheat Sheet (Print This Page)
Before departure checklist: ❏ Buy ExpressVPN (primary) or NordVPN subscription. ❏ Download app on phone + laptop. ❏ Enable obfuscation in settings. ❏ Write down login credentials on paper. ❏ Download backup VPN. ❏ Download Google Translate offline Chinese pack. ❏ Download Baidu Maps offline Beijing. ❏ Download WeChat and register. ❏ Download Alipay and link card. ❏ Save VPN installer files locally. ❏ Write VPN support URLs in notebook. First connection in China: 1. Connect to airport WiFi. 2. Open VPN app. 3. Connect to Hong Kong server. 4. If fails, try obfuscated mode. 5. If still fails, switch to backup VPN. 6. Once connected, test Gmail. During trip: VPN stops working? Try obfuscation → change server → change protocol → restart device → switch WiFi to data → backup VPN → contact support. Return home: ❏ Turn off your VPN when you leave China (no need to keep it on). ❏ Keep your subscription active for your next visit.
Split Tuning: Only Route Blocked Traffic Through Your VPN
Running ALL your traffic through a VPN slows everything down, including Chinese apps like WeChat and Alipay that work fine without it. Split tunneling solves this by routing only blocked services through the VPN while letting everything else connect directly. ExpressVPN: Go to Settings > Split Tunneling > select 'Only allow selected apps to use the VPN'. Check: Chrome, Gmail, WhatsApp, Instagram, Google Maps, YouTube. Uncheck: WeChat, Alipay, Baidu Maps, DiDi, Meituan, Trip.com. NordVPN: Settings > Split Tunneling > 'Choose apps to use VPN'. Same rules apply. Surfshark: Settings > Bypasser > select apps to bypass the VPN (inverse logic - select apps that should NOT use VPN). On iPhone: iOS does not support per-app VPN natively (without MDM configuration). Workaround: Use a VPN that offers per-app tunneling on iOS (few do). Alternative: Simply turn your VPN on and off manually. Use VPN when you need Google Maps or Gmail. Turn VPN off when using WeChat or Alipay. On Android: Per-app VPN is natively supported. Go to your VPN app settings and configure which apps route through VPN. This is the best platform for split tunneling. Pro tip: Configure your browser to use the VPN while keeping all other apps on direct connection. This way you can browse Google, check Gmail, and use WhatsApp in the browser while WeChat and Alipay run at full speed. This single setting makes your China internet experience dramatically better.
Hotel WiFi vs Mobile Data: Which Works Better for VPN?
Your connection method dramatically affects VPN reliability. Here is the definitive breakdown: Hotel WiFi (5-star international chains): Best option. Hotels like Marriott, Hilton, Shangri-La, and InterContinental have business-grade internet that is less restricted. These hotels cater to international business travelers and their IT departments actively ensure VPN compatibility. Connection success rate: 90%+. Hotel WiFi (local/budget hotels): Highly variable. Some have excellent connections, others are practically unusable. Connection success rate: 50-70%. Chinese SIM card mobile data (China Mobile, China Unicom, China Telecom): Very reliable for VPNs in most cities. Beijing has excellent 5G coverage. VPN connection success rate: 80%+. Downside: you need a Chinese SIM card (available at airports). Roaming international SIM (your home carrier's roaming): Works well for basic access but data is expensive ($10-20 per GB). VPN success rate: 70%+. Public WiFi (Starbucks, McDonald's, coffee shops): Generally works well. These are consumer-grade connections with minimal restrictions. Success rate: 75%+. Airport WiFi: Variable. Beijing Capital Airport (PEK) Terminal 3 is generally good. Daxing Airport (PKX) has excellent connectivity. Success rate: 70-85% depending on terminal. Train station WiFi: Unreliable. Requires Chinese phone number for SMS verification. Skip this. Data card (eSIM): Services like Airalo and Holafly offer China eSIMs. Important: these use Chinese carriers under the hood, so VPN behavior is similar to Chinese SIM cards. VPN success rate: 75-85%. Best setup: Buy a Chinese SIM card at the airport (China Unicom has tourist SIMs at both Beijing airports). Use this as your primary data connection with your VPN running. Keep your home SIM in the second slot for SMS verification codes. This gives you the best of both worlds: reliable data + access to verification codes.
Emergency Last Resort: When Every VPN Fails (Shadowsocks & V2Ray)
If all your commercial VPNs fail simultaneously (which happened in December 2024 during a major firewall upgrade), you need a backup plan that does not rely on commercial providers. This is where Shadowsocks and V2Ray come in. What is Shadowsocks: A lightweight SOCKS5 proxy designed specifically to evade deep packet inspection. It was created by a Chinese developer for exactly this purpose. Unlike VPNs that encapsulate all traffic, Shadowsocks makes your traffic look like regular HTTPS. It is much harder to detect and block. What is V2Ray: The evolution of Shadowsocks. More protocol options, more transport methods (WebSocket, HTTP/2, QUIC, mKCP), and better obfuscation. Can disguise traffic as regular web browsing, making it nearly impossible to distinguish from normal internet traffic. How to get one: Option A: Ask a tech-savvy friend outside China to set up a Shadowsocks server for you. They can run it on a cheap VPS ($5/month on Vultr or DigitalOcean). Option B: Purchase a Shadowsocks subscription from providers like Shadowsocks.nu or Shadowsocks.com (note: some of these are blocked in China, so set up before travel). Option C: Use a VPS provider (Vultr, DigitalOcean, Linode) and install Shadowsocks manually. Emergency setup from inside China: If all VPNs are down and you have no proxy: 1) Contact your VPN's live chat support and ask for their Shadowsocks configuration as a temporary workaround (ExpressVPN and NordVPN both provide this for China users). 2) Ask a friend outside China to set up a Shadowsocks server for you (they can do this in 15 minutes using a script). 3) Use SSH tunneling if you have access to a server outside China (technical, but works). 4) Tor Browser (extremely slow in China but works for basic text browsing). Pro tip: Set up Shadowsocks or V2Ray BEFORE your trip as a third-layer backup. Even if you never use it, having it ready gives you peace of mind. Store the configuration as a QR code screenshot on your phone - most Shadowsocks clients can scan a QR code to import configuration.
Speed Optimization: Make Your VPN Fast Enough for Video Streaming
A common complaint about VPNs in China is slow speed. Here is how to get the fastest possible connection: Server selection: Hong Kong servers are fastest (physical proximity). Japan and South Korea are second best. Singapore is third. US and Europe servers will be noticeably slower (500ms+ latency). Avoid servers labeled 'obfuscated' for speed - they are slower by design. Use obfuscation only when non-obfuscated connections fail. Protocol selection for speed: WireGuard/NordLynx is fastest (30-50% faster than OpenVPN). OpenVPN UDP is faster than TCP. OpenVPN TCP is slowest but most reliable. Use WireGuard when speed matters (streaming video). Switch to OpenVPN TCP when reliability matters (important messages). Time of day optimization: VPN speeds in China are fastest between 11 PM and 7 AM (low usage). Slowest between 7 PM and 11 PM (peak evening usage). Plan large downloads for off-peak hours. Device optimization: Close all background apps before connecting. Disable automatic cloud backups while using VPN. Use a wired Ethernet connection on laptops if available (eliminates WiFi interference). Restart your phone every 48 hours to clear network caches. Streaming-specific tips: Netflix: Connect to a server in your home country (or a country where Netflix has the content you want). YouTube: Hong Kong servers typically give the best YouTube speeds (1080p streaming is achievable). Spotify: Connect before opening the app; cache your playlists for offline listening while on VPN. Video calls (WhatsApp, FaceTime): Use OpenVPN TCP for stability over speed. Voice calls need consistent connection, not maximum speed. Realistic speed expectations: With optimal setup, expect 15-40 Mbps download speed on a VPN in Beijing. This is enough for 1080p video streaming, video calls, and all browsing. Without optimization, you might get 2-8 Mbps. The difference is entirely in configuration.
Per-Device VPN Guide: Exact Settings for Phone, Laptop, and Tablet
Each device type needs different VPN configuration. Here is the exact setup for each: iPhone/iPad: Settings that matter: VPN protocol selection - use IKEv2 if available (native iOS support, very stable). OpenVPN is second best. Enable 'Connect on Demand' so VPN auto-reconnects if disconnected (Settings > VPN > i > Connect on Demand). Critical: Turn off 'VPN Kill Switch' on iOS if available (it causes more problems than it solves on Apple devices). Recommended VPN app: ExpressVPN (best iOS implementation). App Store download before China trip. Per-app VPN not available on iOS without enterprise configuration. Workaround: Use Safari with VPN ON for Google services, switch VPN OFF for Chinese apps. Android phone: Most flexible VPN platform. Enable per-app VPN in VPN app settings. Only route through VPN: Chrome, Gmail, WhatsApp, Google Maps, YouTube, Instagram. Direct connection: WeChat, Alipay, Baidu Maps, DiDi, Meituan. Enable 'Always-on VPN' in Android system settings (Settings > Network > VPN > gear icon > Always-on VPN). Enable 'Block connections without VPN' as a kill switch. Download .apk backup files before travel in case you need to reinstall. Windows laptop: Install both primary and backup VPN desktop apps. Configure VPN to auto-start with Windows. Enable 'Kill Switch' feature (prevents data leaks if VPN drops). Set OpenVPN TCP port 443 as fallback protocol. Configure network adapter to disable IPv6 (this prevents DNS leaks). MacBook: Similar to Windows. Install VPN app and enable 'Connect on Launch'. Use 'Kill Switch' feature. MacOS has excellent native VPN support - IKEv2 works particularly well. Pro tip: Set up a 'VPN shortcut' widget on your phone's home screen so you can connect/disconnect with one tap. On iPhone, use the Shortcuts app to create a VPN toggle. On Android, most VPN apps have a home screen widget.
Last updated: · Next review: ·Prices and policies may change. We verify all information regularly.
Planning Your Beijing Trip?
Get our complete guide and checklist plus personalized tips from our local team.
Hidden Beijing Recommends
Every recommendation on this site is based on our team's personal experience and testing. We do not accept payment for positive reviews. All suggestions are curated to help you have the best possible experience in Beijing.
Hidden Beijing's Curated Hotels
We personally inspect and recommend hotels that offer the best value, location, and English-friendly service for international travelers. Our top picks include boutique hotels in hutongs, business hotels in CBD, and luxury options in Wangfujing.
Our team inspects every hotel before recommendationHidden Beijing's Restaurant Picks
Hand-selected restaurants where foreigners feel welcome, menus have English descriptions, and the food represents the best of Beijing cuisine. From Peking duck to street food, we guide you to the right spot.
Tested and verified by our local teamVPN Services Tested in Beijing
We regularly test VPN performance inside Beijing. Our recommendations are based on actual connection tests at Beijing hotels, coffee shops, and mobile networks. We update our findings monthly.
Tested inside Beijing and refreshed regularlyHidden Beijing curates every recommendation personally. We never accept payment for listings.