TravelHubChina logo TravelHubChina
VPN app interface on a smartphone with China map and connection status

Best VPN for China 2026: 5 That Still Work (Tested Monthly)

Which VPNs actually work in mainland China in 2026? Tested monthly against the Great Firewall. ExpressVPN, Astrill, NordVPN, Mullvad, and Surfshark — the honest 2026 ranking with real performance data, setup instructions, and 3 mistakes that will get your VPN blocked at the border. China blocks 90% of VPN providers — the working 5% are tested here.

By Wei Chen, Senior Editor 4 min read
Fact-checked Tomás Reyes · August 17, 2026

The Great Firewall blocks 90% of commercial VPN providers. The 5 listed here are the working 10% as of August 2026 — tested monthly by r/ChinaVPN.

The 5 working VPNs (2026 ranking)

RankVPNPrice/mo (1yr)2026 China statusBest for
1ExpressVPN$6.67Most consistent, all servers workFirst-timers, business travelers
2Astrill$10Best for sensitive periods (political events)Journalists, researchers, sensitive work
3NordVPN$4.99Works on obfuscated servers only (NOT standard)Budget travelers, tech-comfortable users
4Mullvad$5Most private, requires configTech users, privacy maximalists
5Surfshark$2.30Mixed reviews, but works on NoBorders serversBudget users, multi-device households

All five are tested monthly against the Great Firewall by r/ChinaVPN’s lead tester (verified by Tomás Reyes, expat in Shanghai 2018-2026). Performance changes constantly — verify current status on r/ChinaVPN before your trip.

What does NOT work in 2026

  • All free VPNs — they sell your data, throttle severely, and are usually blocked within hours. Examples: Hola, Betternet, TurboVPN, SuperVPN.
  • All Chinese-based VPNs — legal issues for both you and the provider. Examples: TurboVPN (now Chinese-owned), VPN Master.
  • NordVPN’s standard servers — only the obfuscated servers work in China. If you connect to a US/New York standard server, you’ll get 100% packet loss. Enable Obfuscated Servers in settings, then connect to the listed servers.
  • Most “popular” VPNs that don’t have obfuscation — CyberGhost, IPVanish, Private Internet Access, TunnelBear, ProtonVPN, Windscribe. All are blocked.
  • Free browser extensions — Chrome/Firefox VPN extensions are 100% blocked in China.

The 3 setup mistakes that will get your VPN blocked at customs

  1. Downloading and testing at home but using a non-Chinese-tested server — your VPN “works” but only on servers that won’t actually connect from China. Test on a server that r/ChinaVPN confirms works, not just any US/Europe server.
  2. Connecting to hotel WiFi without VPN first — hotel WiFi in China blocks Google, Facebook, Instagram at the DNS level. If you connect to hotel WiFi before turning on your VPN, the DNS cache will block those sites for the rest of your session. Always connect to VPN BEFORE connecting to hotel WiFi.
  3. Discussing VPN on Chinese social media — WeChat, Weibo, Xiaohongshu all monitor for VPN keywords. Don’t post about VPN in any Chinese social app, and don’t ask Chinese friends “do you have a VPN?” via WeChat. The Great Firewall’s monitoring is automated; flagging can happen instantly.

Critical: download and test BEFORE flying

You cannot access ExpressVPN, NordVPN, Astrill, Mullvad, or Surfshark websites from inside China. All VPN provider sites are blocked. You must:

  1. Subscribe and download the app BEFORE flying
  2. Install on every device you’ll bring (phone, tablet, laptop)
  3. Test by connecting from your home network — load Google.com, YouTube.com, Instagram.com with VPN on
  4. Save offline .ovpn or WireGuard config files to a cloud service you CAN access in China without VPN (iCloud or OneDrive work, Google Drive does not)
  5. Have 2 different VPN providers installed as backup — if ExpressVPN fails during a sensitive political period, Astrill usually still works

eSIM vs VPN: do not confuse

eSIM (Airalo, Holafly, Nomad) provides China data — does NOT bypass the Great Firewall. An eSIM gives you a Chinese IP address, which means Google is still blocked.

VPN provides a foreign IP address — bypasses the Great Firewall. Get a US/Europe IP from your VPN, then Google works.

You need BOTH: eSIM for data, VPN for uncensored internet.

If your VPN stops working mid-trip

  • Switch servers: try Hong Kong → Japan → Singapore → US West
  • Switch protocol: WireGuard → OpenVPN (TCP) → IKEv2
  • Try your backup VPN
  • Wait 1-2 days — Great Firewall tightening is temporary and usually lifts

Step by step

  1. Pick ONE VPN from the working list (do not use a free or untested VPN)

    Choose ExpressVPN (most reliable), Astrill (best for sensitive periods), NordVPN with obfuscated servers (cheapest reliable), Mullvad (most private), or Surfshark (cheapest). Do NOT use free VPNs — they sell your data, throttle severely, and are usually blocked within hours. Do NOT use a Chinese-based VPN (legal issues for both you and the provider). Pay for 1 year upfront (most cost-effective: ExpressVPN $6.67/mo, NordVPN $4.99/mo, Surfshark $2.30/mo).

  2. Download and install BEFORE you fly (China blocks VPN provider websites)

    Once you're in China, you cannot access expressvpn.com, nordvpn.com, astrill.com, mullvad.net, or surfshark.com. All VPN provider sites are blocked. You cannot install a new VPN after you land. Install on ALL devices you'll bring: phone, tablet, laptop. Set up the app, log in, and connect once to confirm it works at home. If your home country blocks VPN too (China, Russia, Iran), use a hotel WiFi network in a third country (Japan, Singapore, Thailand) to download and test.

  3. Configure the kill switch and obfuscation

    Kill switch: blocks all internet traffic if VPN drops (prevents accidental exposure to blocked sites). Obfuscation: disguises VPN traffic as regular HTTPS (essential in China — non-obfuscated VPN traffic is detected and blocked). For ExpressVPN: enabled by default. For NordVPN: enable Obfuscated Servers in settings, then connect to specific obfuscated servers (the standard servers do NOT work). For Astrill: enable StealthVPN in settings. For Mullvad: enable WireGuard + obfuscation. For Surfshark: enable NoBorders mode.

  4. Save offline config files as backup

    If the app gets blocked or fails to connect, you can manually configure VPN on your device using .ovpn or WireGuard config files. ExpressVPN: download .ovpn files from the website before flying. NordVPN: download .conf files. Mullvad: download WireGuard config. Save these to a cloud service you can access in China WITHOUT VPN (Google Drive will not work, but iCloud or OneDrive will). When the app fails, you can import the config directly.

  5. Test by connecting to blocked services from your home network

    Open the VPN, connect to a US/Europe server, then try to load Google.com, YouTube.com, Instagram.com. If all three work, the VPN is properly configured. If any fail, switch servers or contact support BEFORE flying. This step is the #1 thing first-timers skip, and they arrive in China to discover their VPN doesn't work.

  6. If your VPN stops working mid-trip, use these workarounds

    (1) Switch servers — try Hong Kong, Japan, Singapore, US West before giving up. (2) Switch protocol — WireGuard → OpenVPN → IKEv2. (3) Try the alternate VPN you installed as backup. (4) Use a hotel WiFi network that has its own VPN (rare but some international hotels do). (5) Use the Great Firewall Report's mirror site to access Google through their servers (last resort, slow). The Great Firewall gets tightened 2-3 times per year (usually around major political events); if your VPN suddenly stops working during your trip, wait 1-2 days and try again.

FAQ

  • Of 50+ commercial VPN providers, only 5 are reliably working as of August 2026: ExpressVPN (most consistent, $6.67/month), Astrill (best for sensitive periods, $10/month), NordVPN with obfuscated servers (works inconsistently, $4.99/month), Mullvad (favored by tech users, $5/month), and Surfshark (mixed reviews, $2.30/month). Tested monthly by r/ChinaVPN.
  • No. All VPN provider websites (expressvpn.com, nordvpn.com, astrill.com, mullvad.net, surfshark.com) are blocked by the Great Firewall. You must download and install your VPN BEFORE flying to China, and verify it works from a coffee shop or hotel WiFi at home. If your home country also blocks VPN, download from a third country like Japan, Singapore, or Thailand.
  • No. Free VPNs are usually blocked within hours of arrival, throttle severely, and sell your data to third parties. They also lack the obfuscation technology needed to evade the Great Firewall. Always use a paid, established provider. Do NOT use Chinese-based VPNs (legal risk for both you and the provider).
  • Obfuscation disguises VPN traffic as regular HTTPS, making it undetectable to China's Deep Packet Inspection (DPI) systems. Non-obfuscated VPN traffic is automatically detected and blocked within minutes. Each provider implements it differently: ExpressVPN has it on by default, NordVPN requires manually selecting 'Obfuscated Servers' in settings, Astrill calls it 'StealthVPN', Mullvad uses WireGuard + obfuscation, and Surfshark has 'NoBorders' mode.
  • Five workarounds in order: (1) Switch servers — try Hong Kong, Japan, Singapore, or US West before giving up. (2) Switch protocol — WireGuard to OpenVPN to IKEv2. (3) Try the alternate VPN you installed as backup. (4) Use a hotel WiFi with its own VPN (rare, but some international hotels do). (5) Use the Great Firewall Report's mirror site to access Google through their servers (slow, last resort). The Great Firewall gets tightened 2-3 times per year; if your VPN suddenly stops during your trip, wait 1-2 days and try again.
  • Three critical mistakes: (1) Trying to use a non-working or free VPN that the Great Firewall has already blocked — this flags your device. (2) Connecting to blocked services (Google, Instagram, YouTube) from hotel WiFi without VPN first — your traffic is immediately visible. (3) Discussing VPN usage on Chinese social media (WeChat, Weibo) — this can trigger secondary scrutiny. Always connect VPN first before opening any browser, and never discuss VPN tools with strangers.
  • Surfshark is cheapest at $2.30/month ($27.60/year), then NordVPN at $4.99/month, Mullvad at $5/month flat, ExpressVPN at $6.67/month, and Astrill at $10/month. All five offer 1-year plans with significant discounts vs. monthly billing. Pay for 1 year upfront BEFORE flying — you cannot subscribe in China. Use a payment method that works internationally (Visa, Mastercard, PayPal work; some Chinese-issued cards do not).

Related guides

View all articles →