Do VPNs Work in China? What NordVPN, ExpressVPN and Others Say Themselves

Each entry below reports only what the provider says on its own website or help centre. Nothing here comes from forums or review sites, and nothing here rates anyone’s speed. These pages change often, so check the provider’s current page before you travel.

• NordVPN: its help centre has a separate “I can’t connect from China” article for each platform. The iOS and Android articles say the NordVPN app for that platform is fully blocked in China and give the steps for a manual IKEv2/IPsec connection instead. A separate article for countries with internet restrictions suggests trying the NordWhisper protocol, Obfuscated servers and OpenVPN (TCP), and notes that connecting from China follows different steps.
• ExpressVPN: we did not find a page in its help centre that addresses China by name. Its connection troubleshooting page says that users in a country with a high level of internet censorship who still cannot connect should contact its support team, and its features page says the app uses automatic obfuscation on supported platforms. Neither page mentions China, and results reported by users vary, so ask its support team directly.
• Surfshark: its own article on using a VPN in China (updated May 2026) says it cannot guarantee flawless access at all times because of external factors beyond its control, that the app switches to NoBorders mode when it detects it is being used in China, and that you should set it up before you go and try the manual setup if the app will not connect.
• Proton VPN: its support page on using Proton VPN in China says that no VPN service can guarantee 100% reliability in China because the restrictions keep evolving. It advises downloading and setting up the app before travelling and enabling two anti-censorship features: the Stealth protocol and alternative routing.
• Mullvad: its help guide for restrictive locations (updated April 2026) says the Great Firewall is blocking all Mullvad servers in Asia, and suggests enabling the app’s anti-censorship methods one at a time: WireGuard port, LWO, QUIC, Shadowsocks and UDP-over-TCP.
• Astrill: its setup manual describes StealthVPN as its customised version of the OpenVPN protocol and calls it the company’s solution for China, available only in Astrill’s own software. We did not find a statement from Astrill that either guarantees or disclaims availability.

• Default protocols are easy to identify. These products were designed for encrypting public Wi‑Fi and changing your streaming region. Their default protocols are built for speed and have a fixed traffic pattern, which the network in China recognises and blocks. That is why each provider added an obfuscation or stealth mode, and why you usually have to turn it on yourself.
• Large shared server pools get blocked in bulk. A big brand’s server addresses are used by many customers and are easy to collect. When a VPN worked yesterday and fails today, the usual cause is a blocked address, not a broken setting on your device.
• The app and the website may be unreachable from inside. The provider’s site, its app-store listing and its login and update services can all be blocked. Installing after arrival is often impossible, so install and sign in before you leave.
• Every network behaves differently. The same VPN can act differently on hotel Wi‑Fi, an office network and mobile data, and the three Chinese carriers differ from each other too. Someone else’s success does not predict yours.

• An obfuscation or stealth mode. The names differ (Obfuscated, Stealth, NoBorders, anti-censorship), and the purpose is the same: making the traffic look like something other than a VPN. Find the setting before you travel and confirm you know how to enable it.
• A protocol option that runs over TCP or resembles HTTPS. Hotel and office networks often restrict UDP, and a TCP-based option holds up better there.
• Manual configuration. When the app itself is blocked, you connect with the system’s built-in VPN or a third-party client. Save the manual setup instructions and the server details on your phone where you can read them offline.
• Several regions and servers. When one address fails you switch to another, so save more than one.
• The refund window. Read the conditions and the number of days, and treat it as your testing period inside China.

One limit to be clear about: a test outside China proves the app is installed and the account works. It cannot prove the VPN will connect from inside. The real test happens after you land, which is why the refund window and the second option matter.

1. Install the app on your phone, laptop and tablet, and sign in on each. Your app-store country can decide whether the app is downloadable, so sort that out at home.
2. Turn on the obfuscation or stealth mode and connect once at home to confirm that mode itself works.
3. Save the manual setup guide, the server details and the support contact as offline files or screenshots.
4. Try it once on mobile data and once on Wi‑Fi. The two can behave differently once you are in China.
5. Set up a second option (next section) and test that too.

A second option gives you a working connection while you fix the first one: downloading a new client, changing a configuration, reaching support or requesting a refund. It should differ from your main choice as much as possible, so that both do not fail together.

Two common choices are a roaming eSIM whose data exits outside China (see eSIM vs VPN in China) and a second VPN built on different protocols. If the main one fails after arrival, follow the order in VPN not working in China.

This section is about us, so it sits last and is labelled as such. We serve one group only, users in mainland China and Chinese people overseas, and the service is built differently from a global brand:

• Six connection methods on one account: router, OpenVPN, Cisco (AnyConnect), Hiddify, web proxy and private network (Tailscale). Blocking of the different protocols is independent, so when one fails you switch to another on the same account. See which connection method fits which scenario.
• Methods that look like ordinary HTTPS: Cisco runs over TLS like any HTTPS site, and the web proxy runs over an encrypted HTTPS connection. See Does Cisco AnyConnect work in China?
• Clients from official vendors and well-known open-source organisations (Cisco, OpenVPN, Hiddify, Tailscale), offered unmodified, so the service does not depend on one in-house app. The most that gets blocked is an address; a blocked address is replaced automatically and the address saved in your client stays the same.
• Router firmware: buy a router with it installed, or flash firmware generated on this site onto your own, log in once, and every device on that router takes the route. See travel VPN router for China.
• Try before you buy: a 24-hour free trial with no credit card, and refunds available at any time, pro-rated by time used (see the refund policy). That lets you test from inside China, on your own network.