6 min read
In mainland China it isn't individual services that stop working but entire protocols: OpenVPN, L2TP and SSTP are cut off almost completely. One class of solution survives — the ones indistinguishable from ordinary HTTPS that also know how to answer correctly when the system checks them itself. That's the defining feature of the Great Firewall: it doesn't only listen to traffic, it actively connects to suspicious servers. Here's how that works and what it means for a trip.
1. Reset injection. The system sends forged TCP RST packets to both client and server: "connection closed". It works because the equipment sits closer to the user than a server abroad does, so its packet arrives first. From the outside it looks like an abrupt drop for no reason.
2. DNS response tampering. A query for a blocked site's name gets a forged answer — faster than the real one arrives. That's why changing DNS server alone helps little: the answer is substituted in transit.
3. Active probing. The most important part. The system notices a connection with an unusual handshake, records the server's address, and later sends it a probe of its own. If the server replies like a VPN server, the address goes on a blacklist.
The third point explains why servers that worked yesterday stop working in China, and why encryption alone doesn't save you: what's being checked is behaviour, not content.
| Protocol | Why it fails | |---|---| | OpenVPN | recognisable first-packet pattern; barely functions in mainland China | | L2TP/IPsec, PPTP, SSTP | trivially identified, blocked long ago | | Plain WireGuard | fixed packet structure and sizes | | Shadowsocks without plugins | characteristic entropy in the first bytes gives it away | | Hysteria2 and other QUIC solutions | QUIC is throttled broadly in China precisely because of VPNs built on it |
They share one trait: a signature of their own. Once a protocol has recognisable handwriting, it's only a question of when it lands in a rule.
VLESS with Reality masking. By the accounts of operators and researchers this is the protocol that most consistently survives Chinese filtering. Two reasons, working together:
That second property is what separates Reality from merely "a VPN over TLS": in China, masking the stream without a convincing answer to inspection isn't enough.
The technical side: what Reality and VLESS are. Comparison with the rest: Hysteria2, TUIC and AmneziaWG.
This is the section that matters most, and the order matters more than the content.
For mainland China the nearest sensible points are Singapore and Japan. Distance sets latency more than any setting: Singapore is roughly 2,500 km from China's east coast, meaning a physical floor around 25 ms and a realistic 50–80 ms.
European and American locations work from China but with hundreds of milliseconds of latency — tolerable for messaging, not for calls or maps. The latency arithmetic: why a VPN slows you down.
In descending order of likelihood:
China regulates the provision of VPN services: an operator has to be licensed. Liability for an ordinary user is an area where the wording is vague and practice shifts. A sensible position for a visitor: use it for work and for contact with home, don't publicly promote circumvention tools, and go by the rules in force at the time of your trip.
The service runs on exactly VLESS with Reality — the protocol that survives Chinese filtering longest, because it has no signature of its own and answers active probing correctly. The nearest location in the network to China is Singapore; there are over a hundred servers in total, so switching takes a second when one address is restricted. One app across the Apple line plus builds for Android, Android TV and Windows: no need for a separate client per device, and there's no device limit.
Download before the trip, while app stores are still available:
What we don't promise: no service can guarantee operation in China, and "guaranteed to work in China" claims are marketing. We use the protocol with the best survival record and keep spare locations.
How comparable systems work elsewhere: VPNs in the most censored countries and VPN for Iran.
Does a VPN work in China in 2026? The class of protocols that is indistinguishable from ordinary HTTPS and survives active probing does — above all VLESS with Reality. OpenVPN, L2TP and SSTP barely get through.
Why did my server work yesterday and not today? Most likely its address was restricted after active probing. Change server within the same location.
Can I download the app once I'm in China? Don't count on it: app stores are restricted. Install the client and sign in before travelling.
Which country should I connect to from China? Singapore or Japan, the nearest large hubs. Europe and the US work but with hundreds of milliseconds of latency.
Does changing DNS help? By itself, barely: answers are substituted in transit. You need a tunnel inside which name lookups aren't visible.
How to bypass internet blocks in 2026: VPN with Reality, proxies, Tor and encrypted DNS. What defeats DPI and why your VPN connects but nothing loads. More
DPI inspects how your traffic looks and blocks VPNs by their fingerprint. Learn what DPI is and how BessyConnect with VLESS+Reality bypasses DPI blocking. More
Reality and VLESS explained simply: how a VPN hides inside normal website traffic so blocks can't see it. BessyConnect runs on VLESS+Reality out of the box. More
