Why did my VPN suddenly stop working in China?

If your VPN worked last week and died this week, the most likely cause is not your subscription and not a banned server address. It is that the network learned to recognise the protocol your VPN speaks, and started dropping it on sight.

That distinction matters, because the two problems have completely different fixes. Changing server, changing city, or buying a different plan does nothing about a protocol block. Changing what the traffic looks like does.

First, work out which failure you have

Three symptoms, three different causes.

It connects, then nothing loads. The tunnel came up and the filter killed it a moment later, or is dropping the traffic inside it. This is the classic protocol-recognition failure. It is also the most common one during a blocking wave.

It never connects at all. Either the server address itself is blocked, or the handshake is being dropped before it completes.

It works on mobile data but not on your home broadband, or vice versa. That is your answer right there: the two networks are running different filtering. Nothing is wrong with the VPN. One network is stricter than the other.

Worth checking that last one before you do anything else, because it is free and it tells you whether you are fighting a national filter or one specific network.

What the filter is actually looking at

Encryption hides what you are saying. It does not hide the shape of how you say it.

Most VPN protocols open with a distinctive handshake, and that handshake is a fingerprint. Researchers at the University of Michigan demonstrated this against OpenVPN in OpenVPN is Open to VPN Fingerprinting (USENIX Security 2022): they identified OpenVPN flows, including obfuscated ones, with very low false-positive rates, and confirmed real-world middleboxes doing the same thing. WireGuard has the same structural weakness. Its handshake is fixed and well documented, which is excellent engineering and terrible camouflage.

Protocols designed to look like nothing at all get caught by the opposite tell. The Great Firewall blocks traffic that is too random. How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic (USENIX Security 2023) documents entropy-based heuristics that flag connections whose bytes look uniformly random, which is exactly what a fully encrypted proxy stream looks like. Being unrecognisable is its own signature.

And when a filter is only suspicious rather than certain, it can ask. How China Detects and Blocks Shadowsocks (IMC 2020) documents active probing: the firewall sends its own crafted connections to a server it suspects, watches how it responds, and blocks it if it answers like a proxy. Your server can be discovered because of how it replies to a stranger, not because anyone leaked its address.

Why blocks arrive in waves

If half your friends lost their connection on the same day, that is not coincidence and it is not your provider being singled out for being popular.

A filtering rule gets deployed, and every service using the protocol that rule matches fails at once. The rules are deployed centrally, so the effect is a cliff rather than a slope. Providers that speak one protocol have one point of failure, and when the rule lands they have nowhere to go until they ship something new.

This is also why the folk advice to "buy a small obscure provider nobody has blocked yet" tends to disappoint. Obscurity is not the variable being measured. Nobody is maintaining a list of brand names. The filter is matching traffic patterns, and a small provider running stock WireGuard matches the same pattern as a large one running stock WireGuard.

What actually helps

The approach that survives protocol recognition is traffic that resembles ordinary web browsing, plus more than one way of doing it, so a rule that kills one method does not end the conversation.

Pangea is built around that. There are five transports, tried in order:

• VLESS + Reality borrows a real site's TLS handshake, so probing and SNI inspection see a genuine site.
• Cloak wraps traffic in TLS aimed at a decoy cover site, so it reads as an ordinary visit there.
• Shadowsocks uses no TLS at all on its own port, so a rule aimed at TLS misses it.
• Hysteria2 runs over UDP and QUIC rather than TCP, which is worth trying when a block is killing every TCP connection.
• NaiveProxy uses real Chromium TLS and HTTP/2, so the fingerprint matches an ordinary browser.

When one gets recognised, the client moves to the next. That is the whole design goal: more than one way through, because any single method eventually meets a rule written for it.

More detail on the specifics is on the China page.

The honest limits

Anyone promising you an unblockable connection is selling you something they cannot deliver, so here is where this approach stops.

A captive portal that demands a login before it routes anything will still stop you, because you never reach the internet to begin with. A total network shutdown is not a filtering problem and no VPN solves it. If the specific address your client connects to gets blocked directly, that connection is down until it moves. And filtering methods keep improving: a transport that is invisible today is a research paper tomorrow.

Two practical notes. Install and test your VPN before you travel, because the sites you would download it from are frequently blocked from inside. And Pangea has not been audited by a third party, which is why the client is GPLv3 on GitHub. Read what it sends before you trust it rather than taking the claim on faith.

If your current setup died this week and you want to try a different approach, there are five days free to test whether it actually holds on your network: see pricing.