- Reliable options (verified 2025-2026)
- ExpressVPN, Astrill, NordVPN, VyprVPN, Mullvad
- Install location
- BEFORE arriving in mainland China — VPN provider sites typically blocked from inside
- Protocol
- OpenVPN + obfuscation, or proprietary protocols (Astrill StealthVPN, ExpressVPN Lightway)
- Backup
- Always have 2 VPN apps installed; one may fail during sensitive dates (Oct 1, congress sessions)
- Hong Kong / Macao
- No VPN needed — different internet rules from mainland
As of May 2026, last reviewed by an LTC editor.
Without a VPN, mainland China is a different internet from what foreigners are used to. Google, Gmail, YouTube, Facebook, Instagram, X/Twitter, WhatsApp, Wikipedia — all blocked. Most Western banking apps, news sites, and SaaS dashboards either don’t work or behave unpredictably. A working VPN is the single most important piece of travel preparation for a foreign visitor — and counterintuitively, it must be installed before you leave home. This guide covers which services work in 2026, how to choose between them, the install-before-arrival rule, and the backup-VPN strategy seasoned expats use.
Why a VPN is mandatory for foreign visitors
China’s Great Firewall (GFW) is the world’s most aggressive content-control infrastructure. It blocks by IP, domain, deep packet inspection, and increasingly by traffic-fingerprint analysis. Three categories of need for foreign visitors:
- Western services blocked at infrastructure level: Google ecosystem (Gmail, Drive, Maps, Translate cloud), Meta (FB, IG, WhatsApp), X/Twitter, YouTube, Reddit, Discord. Without VPN you cannot access these.
- Financial + identity services: many banking apps, 2FA SMS services, and identity-verification flows fail without a stable connection to Western servers. Critical if you need to access work email or financial accounts during the trip.
- News and research: international news outlets are increasingly blocked or rate-limited. Wikipedia is partially blocked. Many academic databases require non-mainland routing.
Hong Kong and Macau Special Administrative Regions are NOT behind the firewall — internet works normally there. Crossing the border into mainland China is when the wall begins.
The install-before-arrival rule
The most-skipped step is the most important. Major VPN provider websites are themselves blocked inside mainland China. If you arrive without one installed, you cannot easily download one — the App Store regional restrictions also play into this. Install your chosen VPN(s) before you fly. Test that they connect and work from your home country. Confirm payment is set up. Then once you cross the border, just open the app and connect — the service itself is reachable through the established connection.
VPNs that work in 2026 — current reliability shortlist
The GFW evolves constantly; what works in January may struggle in November. The shortlist below is what foreign visitors and long-term expats consistently report as reliable as of mid-2026:
- ExpressVPN — the most consistently recommended for first-time China visitors. Strong obfuscation, large server network. Roughly $13/month at standard pricing; 12-month plans cheaper.
- Astrill — Hong-Kong-based, China-focused. Higher price (~$15-20/month) but historically the most reliable through GFW upgrades. StealthVPN protocol designed specifically for deep-packet-inspection bypass.
- NordVPN — works but increasingly inconsistent in mainland China. Better outside China than inside. Useful as a backup.
- Mullvad — privacy-focused, accepts cash. Less optimised for GFW bypass but works when others don’t due to its low profile.
- VyprVPN — Chameleon protocol designed for GFW. Less common now but historically strong.
What NOT to use: free VPNs (rarely work, often track your data), older brands with stale Chinese server lists, and Chinese-domestic VPNs (technically illegal for foreigners to use; can carry account-restriction risk).
The backup-VPN rule
Always have two VPN apps installed. The GFW occasionally targets specific providers during politically sensitive dates (early October National Day, party congress sessions, Tibet anniversaries, Tiananmen anniversary). If your primary VPN suddenly stops connecting, switching to a backup is the fastest fix. Common pairing: ExpressVPN as primary, Astrill or NordVPN as backup.
Choosing a VPN — key factors
- Obfuscation/stealth protocols: this is the most important feature for China. The provider must hide that you’re using a VPN at all — standard OpenVPN handshakes are easily detected. Look for “StealthVPN” (Astrill), “Lightway” (ExpressVPN), “Chameleon” (VyprVPN), or “obfsproxy” support.
- Server count + geography: more servers means more options if some get blocked. Servers in Hong Kong, Japan, Singapore, Taiwan, and US West Coast typically give the best China-side performance.
- Speed: throughput drops 30-60% through VPN; for video calls and 4K streaming you want a top-tier provider.
- Customer support: 24/7 live chat matters when you can’t connect at 2am the night before a meeting. Astrill and ExpressVPN have the best support; budget VPNs typically don’t.
- Mobile + desktop app coverage: install on every device you’ll use. iOS App Store regional restrictions matter — make sure to download from your home country’s App Store before flying.
VPN protocols explained
Most VPN providers offer multiple connection protocols. Three categories matter for China:
- Standard protocols (OpenVPN, WireGuard, IKEv2): detectable by GFW. Don’t rely on these inside mainland China.
- Obfuscated protocols (Lightway, StealthVPN, Chameleon): provider-specific. These make VPN traffic look like normal HTTPS web traffic. Use these as your primary protocol in China.
- Shadowsocks (clientless): a separate tool, popular among technical expats. Configurable manually with a server you control. More setup work but very reliable.
Setting up your VPN before you fly
- Choose 2 providers from the shortlist above.
- Subscribe and pay before departure. Pay via credit card or PayPal — Chinese payment methods sometimes get refunded later.
- Install apps on every device you’ll bring: phone, tablet, laptop.
- Test the connection from your home country: connect to a Hong Kong or Japan server, check that you can browse normally.
- Enable obfuscation/stealth mode in app settings before flying.
- Save the provider’s customer-support email + chat URL offline. If you can’t connect on arrival, you’ll need these to troubleshoot.
What HK and Macau don’t require
Hong Kong and Macau SARs run on different internet rules — no Great Firewall. Google, Facebook, WhatsApp all work normally. If your trip starts in HK or Macau and only briefly touches mainland China, you can sometimes skip the VPN entirely. But if you’ll be in mainland for more than a day, install the VPN anyway as insurance.
Practical scenarios for foreigners
- Hotel WiFi: usually doesn’t bypass GFW; some 5-star international hotels offer a “business VPN” but reliability varies. Don’t depend on it.
- Mobile data on Chinese SIM: same — your VPN still required.
- Mobile data while roaming on foreign SIM: ironically often bypasses GFW for the first few hours. Useful as an emergency bridge but expensive.
- Public WiFi (cafes, malls): connectivity is fine; GFW filtering still applies. VPN required.
- Sensitive dates: October 1 (National Day), early-mid June (Tiananmen anniversary), Tibet-related anniversaries, party congresses — VPN reliability drops markedly. Have your backup ready.
Practical tips
- Disable VPN auto-update inside China — Chinese app stores remove VPN clients regularly. Disable auto-updates so you keep the working version.
- Don’t broadcast VPN use — it’s a grey area legally for foreigners (technically illegal but rarely enforced against tourists). Don’t post about it on Chinese social media.
- Keep multiple servers favoured — within your VPN app, save 3-5 favourite servers (HK, Japan, Singapore, US West). When one slows down, switch.
- Test before relying — do a 5-minute video call test on day one to confirm VPN holds up under bandwidth load.
