Does a VPN work in China? What the Great Firewall detects

Sometimes, yes. Many ordinary VPNs connect for a few minutes in China and then stall or drop, because the network does not need to read your traffic to guess that it is a tunnel. It looks at the shape of the connection, and a plain VPN protocol has a recognisable shape.

This post is for adults travelling to or living in mainland China who want their usual apps and sites to load. It explains what the filter looks at, what published research says, and what to do before you land. It does not promise that any VPN will work on every network, and neither will we.

What the filter looks at

A national filter has three cheap ways to spot a VPN, and none of them require decrypting anything.

1. The protocol fingerprint. Plain WireGuard and OpenVPN have recognisable packet patterns and handshakes. A filter that matches them can cut the connection, or throttle it until it is unusable. This is the "connects, then dies after a few minutes" symptom.

2. The name on the handshake. In an ordinary HTTPS connection, the site name is visible in the TLS handshake, before encryption starts. A filter can read that name and cut anything on a block list. The GFW Report documented China blocking encrypted-SNI traffic outright in 2020, which shows that the filter reacts to the handshake and not only to the content.

3. Traffic that looks like nothing. Some tools try to hide by making every byte look random. Researchers found that this is itself a signal. A 2023 USENIX Security paper, How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic, describes the censor flagging connections that have no recognisable protocol at all, then blocking them.

Active probing: they knock on your server

Even when a connection looks ambiguous, the filter can check. It connects to the suspected server itself and sends test traffic. If the server answers like a proxy, the address is blocked. The earlier IMC 2020 study of how China detects and blocks Shadowsocks measured exactly this behaviour.

That is why "switch servers" so often fails. The problem is not one address being busy. The connection announced what it was.

What actually helps

The pattern across the research is consistent: the less your traffic looks like a tunnel, the longer it lasts. In practice that means a transport designed to look like ordinary web browsing.

Pangea ships six transports in one app and tries them in this order: VLESS + Reality, Cloak, Shadowsocks, Hysteria2, NaiveProxy and AnyTLS. They fail in different ways, which is the point:

VLESS + Reality borrows a real site's TLS handshake, so an SNI-based block and a probe both see a genuine site. It is the strongest disguise we have.
Cloak aims its TLS at a decoy cover site.
Shadowsocks carries no TLS of its own, so a block aimed at TLS misses it.
Hysteria2 runs over UDP and QUIC, which helps when every TCP connection is being killed.
NaiveProxy uses real Chromium TLS and HTTP/2, so the fingerprint matches a browser.
AnyTLS pads every TLS record so packet sizes do not form a pattern.

The app moves down the list on its own when one is blocked, so you are not hand-editing configs on a hotel connection.

What can still go wrong

A transport is not a guarantee. A captive portal that wants a login, a full network shutdown, a block of the entry address itself, and filtering methods that do not exist yet can all interrupt a connection. OONI publishes open measurements if you want to see what is being tested and blocked in a country right now.

A VPN also cannot change what your phone number, your accounts or the apps on your device already tell a service about you. It changes the network layer: what the network sees, and what address a site sees.

If you are heading there

Set it up before you travel. Sites and stores you would use to download a VPN may be blocked once you arrive.
Test on the network that matters. Your home wifi proves nothing. Try a different network and connection type once you are there.
Desktop and iPhone. Pangea has Windows and macOS apps, and iOS works through Shadowrocket. There is no Android app yet.
Know what you are paying for. £5.49 a month, or £27.99 a year. Five days free to start, then the plan renews unless you switch auto-renew off in Billing, and there is a 30-day money-back guarantee.
Check the client yourself. The app is GPLv3 on GitHub, and keys are generated on your device. Pangea has not had a third-party audit, so reading the source is the honest way to check.

There is a longer page with the same advice at Pangea for China. If you want to try the transports yourself, start the free trial before you leave and test it on a network that isn't your own.