Why does my VPN stop working in China after a few minutes?

What the firewall is looking at

There are three separate mechanisms, and they fail in different ways.

1. Protocol fingerprints. Plain OpenVPN and WireGuard have recognisable handshakes. A filter that reads the first packets can match them without decrypting anything. This is why those connect nowhere in some networks, or not at all.

2. "Looks like random noise" detection. Some obfuscated protocols try to make every byte look random. Researchers found that the Great Firewall now treats fully random-looking traffic as suspicious in itself. The paper, How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic (USENIX Security 2023), describes simple entropy and byte-pattern checks that block a large share of such connections. Hiding by looking like nothing is a weaker disguise than looking like something ordinary.

3. Active probing. When the firewall suspects a server, it connects to it itself and sends crafted probes. If the server answers the way a proxy would, it is flagged. The IMC 2020 study How China Detects and Blocks Shadowsocks documents this against Shadowsocks servers in detail.

The "works, then stalls" pattern fits that last mechanism well. The first connection gets through, the system takes a closer look, and some minutes later the server is probed or the flow is reset. We cannot see inside a given network, so treat this as the likeliest explanation rather than a diagnosis of your particular case.

What tends to hold up

The general direction is to look like a real, ordinary connection to a real, ordinary site, so a probe gets a boring answer.

• VLESS + Reality borrows the TLS handshake of a real website. A probe sees that site, not a proxy.
• Cloak points its TLS at a decoy cover site, so a visitor who does not hold the key sees an ordinary page.
• NaiveProxy uses real Chromium TLS and HTTP/2, so the fingerprint matches an ordinary browser.
• AnyTLS pads every TLS record, so packet-size patterns that can give away a tunnel inside TLS stop forming.
• Hysteria2 runs over UDP and QUIC, which is worth trying when a block kills TCP connections.
• Shadowsocks has no TLS at all and sits on its own port, so a block aimed at TLS misses it. It is also the one the research above probes most, so it is a fallback, not a first choice.

Pangea ships all six, tried in that order: VLESS + Reality, Cloak, Shadowsocks, Hysteria2, NaiveProxy, AnyTLS. The point of having several is that when one gets noticed, the app has another way to try without you editing config files.

What no VPN can promise

Honest limits, because they are the part other VPN pages leave out:

• Nothing is unblockable. Filtering changes. A transport that works this month can be targeted next month, and the hub address of any service can be blocked outright.
• Set up before you land. Many VPN sites and app stores are unreachable from inside China. Install the app and sign in while you are still on an unrestricted network.
• A VPN does not hide your phone. It protects the connection between your device and the network. It does not change what an app on your phone reports about you, and it does not make a +86 number anonymous.
• Captive portals and full shutdowns will interrupt any connection, including ours.

If you want to check the software before you trust it

The Pangea desktop app is open source (GPLv3), generates its keys on your device, and uses 256-bit encryption. You can read what it does instead of taking our word for it. It is not third-party audited, so reading the code is the check on offer. The monthly warrant canary is signed, and if it stops appearing, that tells you something.

Desktop apps cover Windows and macOS. iOS works through Shadowrocket. There is no Android app yet.

If you are planning a trip, the China page lists how this works in practice and how to set up before you travel.