Why does my VPN stop working in China, and what still connects?

An ordinary VPN stops working in China because the network does not need to know which server you are using. It looks at the shape of the traffic, decides it resembles a VPN, and resets or drops it. Changing server inside the same app often changes nothing, because the thing being recognised is the protocol, not the address.

That is the short answer. The longer one decides what you should try next.

What the filter is actually doing

Three mechanisms matter, and they fail in different ways.

Protocol fingerprinting. WireGuard and OpenVPN open with handshakes that look the same every time. A filter that has seen them before can match the first packets and cut the flow. Our earlier post on whether DPI can detect WireGuard goes through why a fast, clean protocol is also an easy one to recognise.

Blocking traffic that looks like nothing. Researchers at GFW Report and several universities showed in 2023 that the Great Firewall blocks connections whose first packet looks like fully random, encrypted bytes, using simple heuristics on entropy and packet structure. Their paper, How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic, is worth reading in full. The practical lesson: a protocol that tries to hide by looking like noise can be flagged precisely because it looks like noise.

Active probing. Earlier work, How China Detects and Blocks Shadowsocks, showed the firewall connecting back to suspected servers with crafted probes. If the server answers like a proxy, the address gets blocked. This is why a VPN can work for a day on a fresh server and then die.

What tends to hold up, and why

The common thread in the transports that survive is that they look like something the network is reluctant to block, and they behave like it when poked.

Pangea runs five transports and tries them in this order: VLESS + Reality, Cloak, Shadowsocks, Hysteria2, NaiveProxy.

VLESS + Reality borrows a real site's TLS handshake, so a probe sees a genuine site. It is the strongest disguise of the five and goes first for that reason.
Cloak aims TLS obfuscation at a decoy cover site, so the traffic reads as an ordinary visit to it.
NaiveProxy uses real Chromium TLS and HTTP/2, so the fingerprint matches a browser.
Hysteria2 runs over UDP and QUIC. It is worth trying when a block kills every TCP connection.
Shadowsocks has no TLS and sits on its own port. It helps against blocks aimed at TLS, and given the research above, it is not the one to lean on first.

Having several matters more than any single one. When one gets targeted, the app moves to the next instead of leaving you staring at a spinner.

What this does not fix

Be sceptical of anyone who says a VPN cannot be blocked in China. Complete network shutdowns, captive portals, blocking of the hub address itself, and filtering methods nobody has published yet can all stop a connection. Pangea talks to one external address, the hub, and if that address is blocked outright you will notice.

Two practical points:

Sort it out before you arrive. Our site and payment pages can be hard to reach from inside the country. Install the app and sign in while you are somewhere unrestricted.
Check the rules yourself. China regulates cross-border VPN use. We are not lawyers, and what is allowed for a business, a visitor or a resident differs. Read up before you decide.

On the Pangea side: the desktop app (Windows and macOS) is open source under GPLv3, so how it connects is written in code you can read rather than described in marketing. The device generates its own keys, encryption is 256-bit (WireGuard / ChaCha20), and there is a monthly PGP-signed warrant canary. We have not had a third-party audit. iOS works through Shadowrocket, and there is no Android app yet.

If your VPN works for a few minutes and then stalls on a particular network, that is the pattern above and not bad luck. There is a shorter country guide at Pangea for China, and pricing is here: £5.49 a month or £27.99 a year, with a 30-day money-back guarantee.