VPN & eSIM access in China
Nothing works in China all of the time. Blocking varies by ISP, by province, by time of day, and tightens around politically sensitive dates. Anyone promising you a guaranteed connection is selling something.
What follows is our own assessment, weighted by the criteria in our methodology and dated so you can see how current it is. It is editorial judgement, not laboratory measurement, and we say so rather than dressing it up as data.
Conditions change weekly. A number without a date is worthless, so ours never appear without one.
Each claim states where it came from and how it was gathered — vendor documentation, public reporting, or our own checks.
Where the evidence is thin we print a range or say so outright, rather than inventing a score to fill the gap.
We earn commission on some links and nothing on others. Which is which is stated on the page, and it does not set the ranking.
Hold us to these. If you find a figure without a date, a claim without a source, or a recommendation that looks bought, tell us and we will fix it.
Where we read — not endorsements
We do not name one overall winner. Our top three finish within 0.2 points of each other, which is inside the margin of our own judgement — so instead each service carries the category it actually leads in the scoring table, with the score worked out in full so you can check it.
Easiest to use
Top rated for app quality — 9/10, joint highest of any service here
The sensible default for a short trip. Cheaper than it looks — plans now start at $3.49/month — and you trade a little resilience for not having to think about it.
Best value
Top rated for value — 9/10, and the cheapest credible option at $2.49/mo
The budget pick, and a sensible second line to have installed alongside something sturdier.
Most configurable
Widest protocol range, and 8/10 for obfuscation — second only to Astrill
For people who want to tune it themselves. Capable, but it expects competence.
Most reliable
Top rated for bypass reliability and obfuscation strength — 9/10 on both
The expensive one that keeps working. Hard to justify for a fortnight's holiday; hard to argue against if you live there.
Scores are computed from published weights, applied identically to every service. Nothing is hand-set — see every score worked out.
Five questions
Where you are, which ISP you are on, and how long you are staying change the answer. Tell us those and we will point you at the service that fits, along with our reasoning.
Our suggestion
One suggestion, with the reasoning. Whatever you pick, install and test it before you arrive.
A bare WireGuard or OpenVPN tunnel will not hold here. The Great Firewall fingerprints those handshakes readily, which is why several otherwise excellent VPNs perform badly in China while doing nothing wrong technically. What matters is whether the service offers credible traffic mimicry — something that looks like ordinary HTTPS rather than like a tunnel.
Five services score below our threshold and we would steer you away from them. See which, and why →
Community Consensus from Expats in China • Updated Mar 8
We track routing performance for CN2 (China Telecom) and AS4837 (China Unicom) networks. The GFW's behavioral heuristics now enable real-time packet interception and forged TCP RST+ACK injection against standard VPN protocols.
Network: CN2 GIA / 163
Bypass Confidence
Analyst Note: Premium CN2 GIA stable. ALERT (Jan 27): 'Small Whitelist' testing reported; non-verified IPs may face 100% loss.
Network: AS4837 / CUII
Bypass Confidence
Analyst Note: Best for streaming. ACADEMIC ALERT: CERNET now blocks TLS fragmentation—standard SNI bypass fails on campus.
Network: CMNET (Intl)
Bypass Confidence
Analyst Note: Heavy UDP Throttling (8-11PM). MITIGATION: Xray-core v26.1.23 port-hopping confirmed to bypass current throttles.
*Note: "Bypass Confidence" is based on observed TCP Reset rates across major gateway nodes. StealthVPN (Astrill) currently demonstrates the highest resilience across both CN2 GIA and AS4837 networks. Standard WireGuard and OpenVPN are effectively dead.
View Full ISP Connectivity Matrix →Deep-dive technical analysis of VPN protocol performance by Chinese ISP network architecture.
CN2 GIA & AS4134 Network Analysis
Premium CN2 GIA routing offers superior international bandwidth. Why StealthVPN holds up on China Telecom's fibre network, and how DPI entropy analysis shapes protocol choice.
AS4837 & CUII Network Analysis
AS4837 backbone delivers excellent streaming performance but faces unique UDP throttling challenges. Why protocol choice — TCP versus UDP — matters more here than which provider you pick.
Our scores are computed, not asserted: each service is rated against six published criteria, the weights are the same for everyone, and the total is the arithmetic. Run that honestly and the top three land within 0.2 points of each other — inside the margin of our own judgement.
So calling one of them "#1" would be false precision. Astrill leads on raw reliability, ExpressVPN on ease of use, and Surfshark on price. Which of those matters most is a fact about your trip, not about the VPN.
See our full methodology →
Aggregated sentiment from r/China, r/chinalife, and r/dumbclub
| # | VPN Service | Status | Our Score | Trend | Best For | Refund | |
|---|---|---|---|---|---|---|---|
| #1 | ExpressVPN | Stable | 7.6 /10 | STABLE | The sensible default for a short trip. Cheaper than it looks — plans now start at $3.49/month — and you trade a little resilience for not having to think about it. | 30-day | View Site |
| #2 | Astrill VPN | Stable | 7.1 /10 | STABLE | The expensive one that keeps working. Hard to justify for a fortnight's holiday; hard to argue against if you live there. | 7-day | View Site |
| #3 | Surfshark | Patchy | 7.0 /10 | STABLE | The budget pick, and a sensible second line to have installed alongside something sturdier. | 30-day | View Site |
| #4 | TorGuard | Stable | 6.5 /10 | STABLE | For people who want to tune it themselves. Capable, but it expects competence. | 7-day | View Site |
| #5 | PrivateVPN | Patchy | 5.9 /10 | STABLE | Cheap and occasionally effective. Not something to travel on as your only option. | 30-day | View Site |
| #6 | LetsVPN | Stable | 5.8 /10 | STABLE | A China-market app that frequently works. Treat it as a convenience tool, not a privacy tool. | 7-day | View Site |
Security protocols, privacy audits, and technical capabilities verified for China.
| Feature | Astrill | Astrill VPN | ExpressVPN | Surfshark | LetsVPN |
|---|---|---|---|---|---|
| Obfuscation Protocol | Chameleon 2.0 | Chameleon 2.0 | Lightway | Camouflage | Proprietary |
| China-Optimized Servers | |||||
| Kill Switch | |||||
| Split Tunneling | |||||
| No-Log Audit | |||||
| Router Support | |||||
| Simultaneous Devices | 10 | 10 | 8 | Unlimited | 3 |
| Jurisdiction | Switzerland | Switzerland | BVI | Netherlands | Unknown |
The "Triad"Strategy
The GFW uses behavioral heuristics to identify and block specific protocols. Relying on two VPNs that use the same underlying tech isn't redundancy—it's correlated failure. The total collapse of NordVPN, ExpressVPN, and Surfshark proves this. Our community consensus recommends a "Triad" of unconnected technologies:
Goal: Stable Work Tunnel.
Uses closed-source protocols (StealthVPN) optimized for CN2
GIA routing. 10+ years of proven resilience against GFW updates.
Best option: Astrill VPN ($30/mo) — the strongest obfuscation of anything here
Goal: Speed & Ease.
Uses dynamic IP rotation to evade GFW blacklists. Fast one-tap
connection. Privacy warning: unverified provider.
Target: LetsVPN (95%)
Goal: Emergency Access.
International eSIMs bypass the GFW at hardware level via roaming. Unblockable but expensive ($1-2/GB). Recommended as backup only.
View eSIM Comparison →
"True redundancy means if the GFW patches one protocol tomorrow, your eSIM still works. If they degrade international bandwidth, your CN2 tunnel survives."
International eSIMs bypass the Great Firewall at the network infrastructure level—your phone connects to China Mobile/Unicom towers, but traffic exits through Hong Kong or Singapore gateways. No VPN software needed, no protocol detection possible. Useful as emergency backup when VPNs fail during sensitive periods.
| Method | Per GB | 10GB Cost | Our score |
|---|---|---|---|
| Astrill VPN | $0.005 | $0.05 | 6.1 |
| ExpressVPN | $0.008 | $0.08 | 7.2 |
| Astrill VPN | $0.03 | $0.30 | 7.1 |
| eSIM (Airalo) | $1.20 | $12.00 | 100% |
| eSIM (Nomad) | $1.90 | $19.00 | 100% |
*VPN costs calculated from unlimited monthly plans. eSIM costs from 1GB China data packages (March 2026).
Bottom Line: eSIMs cost 120-190x more per GB than VPNs, but do not depend on VPN software surviving a crackdown. Best used as emergency backup (2-3GB), not primary access method.
Compare eSIM providers for China →Cybercrime Prevention and Control Law: Draft law announced Feb 2 introduces 3-year exit bans for cyber-offense convictions and fines up to 20x illegal income. The law is extraterritorial, targeting foreign entities and overseas citizens. Enforcement focus remains on facilitators and operators, not personal end-users. Read full analysis →
Updated for the February 2, 2026 Cybercrime Prevention and Control Law.
On February 2, 2026, the Ministry of Public Security announced the draft Cybercrime Prevention and Control Law. This legislation introduces three-year exit bans for individuals convicted of cyber-related offenses — including facilitating illegal cross-border online activity. The law also targets the "human infrastructure" of the internet: businesses and individuals who provide technical support, payment platforms, or recruitment for activities that bypass content control mechanisms.
For foreign travelers and expats, the practical risk remains low for personal VPN use. However, the law's extraterritorial reach — empowering Chinese authorities to hold overseas citizens and foreign entities accountable — represents a significant escalation from the 2022 Anti-Telecom and Online Fraud Law.
Effective January 1, 2026, amendments to the PRC Cybersecurity Law allow fines up to twenty times the illegal income generated. Where no illegal income is identified, the floor for penalties is RMB 10,000, with severe violations leading to revocation of business licenses.
This "20x rule" functions as an economic kill-switch for domestic VPN providers and anyone facilitating cross-border data flows commercially. Corporate users and digital nomads operating within China should factor this into their risk assessment.
As of August 2026, mainstream commercial VPN brands like NordVPN and ProtonVPN report total connection failure in mainland China. The GFW's behavioral heuristics instantly identify and drop standard WireGuard and OpenVPN handshakes. NordVPN is reported as "useless" by travelers during month-long stays. ProtonVPN is no longer viable for consistent bypass.
These VPNs lack the proprietary obfuscation required to survive China's modern DPI systems. Their primary IP ranges have been effectively "black-holed" by state-run telecoms. Astrill VPN ($5/mo) offers Chameleon 2.0 obfuscation, ExpressVPN (from $3.49/mo) is the easiest option for travellers, while Astrill VPN ($30/mo) is the most resilient choice for long-term expats.
LetsVPN is frequently reported to work, and is convenient for short-term travel. However, it carries significant privacy risks. Users report that the service is run by AI systems, maintains logs of user activity, and has begun aggressive bandwidth-based account locking. Its corporate origin is unknown and unverified.
While effective for accessing social media and messaging apps during a short trip, never use LetsVPN for sensitive activities like online banking, cryptocurrency transactions, or corporate logins. For any user prioritizing long-term safety and data integrity, we recommend Astrill VPN ($30/mo, the most resilient option here) or ExpressVPN (from $3.49/mo, the easiest to set up).
For personal use — accessing Gmail, WhatsApp, and Western news — the practical risk for foreign travelers remains low. There are no reported cases of foreigners being penalized for personal VPN use as of August 2026.
However, the new Cybercrime Law introduces a psychological deterrent via exit bans and the 20x fine mechanism that primarily targets facilitators, not end-users. We recommend discretion and avoiding any commercial resale or distribution of VPN access while in China. The enforcement focus remains on Chinese citizens and domestic operators, but expats should stay informed as the law evolves.
