Why does my VPN not work in China, and what still connects?

If your VPN worked at home and dies in China, the usual cause is not your wifi and not a bad server. The network recognised the connection as a tunnel and cut it. Sometimes that happens at the first packet, sometimes a few minutes in. Switching to another server in the same app rarely helps, because the filter is reacting to what the traffic looks like, not where it is going.

This post explains what the filter looks at, why the common fixes fail, and what kind of VPN design still has a chance. It is written for someone about to travel, or already there and stuck.

Two kinds of failure, and they mean different things

It never connects. The handshake is blocked outright. Typical for plain OpenVPN and WireGuard, whose handshakes have a recognisable shape.

It connects, then dies after a few minutes. This is the one people blame on "bad wifi". It is more often the network classifying the flow after watching it for a bit, or probing the server and deciding it is a proxy.

Telling them apart matters because the fix differs. A connection that dies instantly is a handshake problem. A connection that dies late is a classification problem, and a different node on the same protocol will die the same way.

What the filter can see

A national filter does not need to read your traffic to block it. It sits on the path and looks at things that are visible even when the content is encrypted:

the first packet or two of each connection, and whether they look like a known protocol
the TLS server name (SNI) a connection announces
packet sizes and timing, which can give a tunnel away even inside TLS
what answers when it connects to the server itself and asks

The best public evidence on the first point is the GFW Report's USENIX Security 2023 paper, How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic. The authors found that the firewall uses fairly simple heuristics on the first packet of a connection to flag traffic that looks like random bytes, and blocks it. That is a counter-intuitive result: making traffic look like pure noise is itself a signature.

For measurement of what is blocked at the website level, OONI's China data is the primary public source. It shows anomalies and confirmed block pages over time. An anomaly is a measurement that looks wrong, not proof of a block, so read it as a pointer rather than a verdict.

Why the usual fixes do not work

Changing server. The filter is matching a pattern, so every server speaking the same protocol the same way gets the same treatment.

Changing port. Useful against crude port blocks only. Pattern-based detection does not care about the port number.

"Obfuscated" modes that just scramble bytes. Per the research above, fully random-looking traffic is a known target.

Free VPNs. Many use shared, widely known configurations, so they are the first to be fingerprinted and blocked. A free tier also has to be paid for somehow, which is worth thinking about before you route traffic through it.

What tends to keep connecting

The design idea that holds up is to stop looking like a VPN and look like something the filter does not want to break: an ordinary visit to an ordinary website. That can be done in a few ways, and none is a magic bullet:

Borrowing a real site's TLS handshake (VLESS with Reality), so a probe sees a genuine site.
TLS to a decoy cover site (Cloak), so the connection reads as a normal visit to it.
Matching a real browser's TLS and HTTP/2 fingerprint (NaiveProxy).
Padding every TLS record (AnyTLS), so packet sizes stop forming a pattern.
Running over UDP and QUIC (Hysteria2), worth trying when a block kills TCP connections.
Shadowsocks, which has no TLS at all and sits on its own port, so a block aimed at TLS misses it.

Pangea ships all six of these and tries them in that order inside one app, so you do not have to know which one your network tolerates. The device-to-server channel uses 256-bit encryption, and the desktop app generates its keys on your device. The client is GPLv3, so you can read what it does instead of taking our word for it.

The honest limits

No VPN can promise to work on every network in China, and anyone who does is selling you something. Specifically:

Filtering changes. A transport that works this month can be fingerprinted next month.
If the filter blocks the address of our server directly, a good disguise does not help.
A total shutdown stops everything.
Hotel and airport captive portals can interrupt any VPN before it gets going.
Pangea has Windows and macOS apps, and iOS through Shadowrocket. There is no Android app yet.
Pangea has not been audited by a third party.

What to do before you go

Set it up before you travel. App stores, download pages and sign-up pages can be hard to reach from inside. Install and connect once at home.
Test on a network that is not your home wifi. A VPN that works at home tells you little.
Know your payment path. Pangea costs £5.49 a month or £27.99 a year, with a 30-day money-back guarantee. If you would rather not give a card, you can pay with crypto, Monero included, with no email and no KYC.
Do not expect apps to forget who you are. A VPN changes the network path. It does not change what a phone number, a logged-in account or an app's own permissions reveal.

If you want the short version for travellers, see the VPN for China page. If you are choosing between options, the test worth running on any of them is the one above: does it survive on the network that killed your last VPN.