Short answer
For most visitors in 2026, the best "VPN" is no VPN at all. A travel eSIM roams through a foreign carrier, so your phone's data exits the mainland network before the firewall sees it. Google, Gmail, WhatsApp, Instagram and YouTube work the moment you land, with no app to install and nothing to configure.
You still need a real VPN in exactly one situation: a laptop on hotel Wi-Fi. A travel eSIM covers the device it is installed in, which is normally your phone, so the laptop problem is unsolved by roaming.
If you do carry a laptop, treat a VPN as a backup plan rather than a main one. Standard WireGuard, OpenVPN and IKEv2 are detected and blocked on mainland networks in 2026. Only modes that disguise traffic as ordinary HTTPS still get through, and no brand is reliable enough to promise.
What is actually blocked in China in 2026
Last verified: 28 September 2026. On a mainland network — a Chinese SIM, hotel Wi-Fi or a café connection — these do not load: Google Search and Gmail, YouTube, WhatsApp, Instagram, Facebook, X, and much of the foreign news and streaming web. This is the network working as designed, not a fault in your phone, your SIM or your account.
Chinese apps are unaffected. WeChat, Alipay, Amap, DiDi, Meituan, railway and metro apps all work normally, and so does any site with a mainland server. Your banking app, your airline app and your hotel booking will behave exactly as they do at home.
The filter operates at the network level, which is why no setting inside your phone changes what loads. Moving from your home carrier's roaming plan to a local Chinese SIM, or from a local SIM to a travel eSIM, is a question about the route your data takes, not about the device in your hand. Two guides cover that choice in detail: eSIM and data in China and local SIM versus eSIM.
Why a travel eSIM is the better answer for most trips
An international travel eSIM is a roaming profile. Your phone attaches to a Chinese tower, but the data session is handed to your eSIM provider's home network outside mainland China — Hong Kong and Singapore are the usual exit points — and reaches the public internet from there. The traffic never passes through the filtering that a mainland connection does.
The practical effect is that blocked apps behave normally on mobile data: maps, messaging, Gmail, Google search and the sites you actually need for planning. No protocol to choose, no server to test, no app that might stop working on a Tuesday. It also starts working before you reach the baggage carousel if you install and activate the profile before you fly.
Two limits matter. First, it covers the device it is installed in, and most travel eSIM plans are data-only, so they do not help a second device that connects over hotel Wi-Fi. Second, not every travel eSIM is routed the same way. Some plans connect as local breakout through the mainland network, which leaves you behind the firewall regardless of what the marketing page implies. The eSIM profile does not decide the route; the plan does. Read the plan description and look for international or Hong Kong routing before you buy, and treat any confident "no VPN needed" claim on a plan page as something to verify rather than believe.
eSIM versus VPN: which problem are you actually solving?
These two things are often written about as alternatives. They are not the same tool, and the table below is the fastest way to see which one your trip needs.
| Travel eSIM | VPN | |
|---|---|---|
| When you install it | Before you fly — a QR profile, minutes to set up | Before you fly — app, account, subscription, current version |
| Covers your phone | Yes, as ordinary mobile data | Yes, on any network it can connect through |
| Covers a laptop on hotel Wi-Fi | No, unless you tether and your plan allows it | Yes, this is the case it solves |
| Monthly subscription | No — a one-off plan for the trip | Yes, and you need it active before you travel |
| Works on landing | Yes, if activated before departure | Only if the protocol mode gets through that day |
| Configuration or protocol choices | None | Yes — the wrong mode fails silently |
| Legal question involved | None: it is standard international roaming | Yes: approved versus unapproved services differ in status |
| Best for | Phone-first trips — the large majority of visitors | Anyone working from a laptop in a hotel room |
Read that as decision rules rather than a scorecard. Phone only, short trip: buy an eSIM and skip the VPN entirely. Phone plus laptop, or a work trip with calls: eSIM for mobile data, VPN for the laptop, and expect to spend some time on the VPN if the connection is bad that week.
Which VPNs and protocols still work in 2026
The firewall was upgraded in the second half of 2024 with machine-learning traffic classification, and the effect on the older protocols was blunt. Plain WireGuard, OpenVPN and IKEv2 are now identified and blocked on mainland networks, close enough to universally that changing brands achieves nothing. Shadowsocks has also been detected, through a combination of passive monitoring and active probing. V2Ray works intermittently and degrades without warning.
| Protocol or mode | 2026 status on a mainland network |
|---|---|
| Standard WireGuard | Detected and blocked |
| Standard OpenVPN (UDP or TCP) | Detected and blocked |
| IKEv2 / IPsec | Detected and blocked |
| Shadowsocks | Detected — passive monitoring plus active probing |
| V2Ray | Intermittent; performance swings without warning |
| TLS-obfuscated modes (StealthVPN, OpenWeb, Lightway TCP, obfuscated OpenVPN) | The commercially available category that still connects |
| Self-hosted VLESS + REALITY, Hysteria2 | Reported working for users who run and maintain their own server |
What survives is camouflage. Protocols that make the connection look like an ordinary HTTPS session to a normal website are the ones that get through, because blocking them would break the traffic the country depends on. That is the entire mechanism, and it is why "which brand" matters far less than "which mode is switched on". A service with an obfuscation mode you have actually enabled beats a more famous service running its default protocol.
On which service is best, the sources genuinely conflict. Astrill, ExpressVPN, NordVPN, Surfshark and LetsVPN are each listed first by some reviewers and called unreliable by others, and testing done in different cities on different ISPs reaches different conclusions in the same month. No provider has been shown to be stable for everyone. Anyone telling you otherwise is selling something. The honest position is that the best available option is whichever one connects for you on the day, which is why the advice is to arrive with two providers from different companies and to know where the obfuscation toggle lives in each app.
Is a VPN legal for tourists in China?
Only government-approved VPN services are legal in mainland China. Unapproved VPN services are non-compliant under the 2017 rules issued by the Ministry of Industry and Information Technology. That is the framework, stated plainly, and it applies to the service rather than to the passport you carry.
Enforcement in practice concentrates on providers and on commercial resale — the people selling access — rather than on individual travellers. Reported cases of enforcement action against short-stay foreign visitors are very rare, and there is no published penalty schedule aimed specifically at tourists. That is not the same as a guarantee, and it is not a green light; it is the factual position as it stands.
If you want the conservative route, the travel eSIM does the job without touching this question at all. Roaming on a foreign carrier is ordinary international roaming, which is what every visitor uses, and it involves no software to install and no unapproved service to subscribe to. Deciding between the two is a real decision, and it belongs to you — this page is not going to pretend the choice is obvious in both directions.
What to install before you fly
The order matters more than the list. Everything here has to happen while your home network and app store work normally.
- Buy the travel eSIM and install the profileCheck the plan says international or Hong Kong routing. Install now, activate on arrival or just before departure.
- Turn off data roaming on your home SIMSo your primary line does not quietly bill you per megabyte while the eSIM carries the data.
- Choose two VPN providers from different companiesTwo vendors, not two servers on one account. When one protocol is blocked, the other vendor is the fallback.
- Subscribe and sign in before departurePayment and account creation are the parts you cannot do from inside China. Do it at home, on your own card.
- Find and test the obfuscation modeStealthVPN, OpenWeb, Lightway TCP, an obfuscated OpenVPN profile — whichever your provider offers. Enable it and confirm it connects before you leave.
- Update both apps to the current versionAn older client with a blocked default protocol is the most common reason people arrive connected to nothing.
- Download offline maps and the essentialsAmap or your map app of choice plus the apps you need in China, installed and logged in while you still can.
When the VPN stops working mid-trip
Expect this at least once on a laptop, and know what you will do before it happens. The connection is not usually failing because of your account; it is the mode being detected this week.
- Switch modes, not vendors, first. The obfuscation setting is the variable that matters, and moving from a default protocol to a camouflaged one often restores the connection immediately.
- Use your phone as a hotspot. Tethering the eSIM gives the laptop an international route without any VPN involved. Some plans restrict tethering, so check before you rely on it.
- Expect bad windows around sensitive dates. During major political meetings, enforcement tightens and even good obfuscation gets flaky for days. If work is on the line, plan around those dates rather than fighting them.
- Hong Kong and Macau are unfiltered. A day trip into Hong Kong resets everything: Google, Gmail and the rest load normally on any connection.
- Do the important work on mobile data. If a laptop task can wait until you are on a mainland network again, the eSIM route on your phone is the least fragile connection you have.
Turn the VPN off for Chinese apps
Leave the VPN off when you pay or book inside China. WeChat Pay, Alipay and DiDi can flag a foreign IP address as unusual account activity, and a declined payment in a restaurant queue is a bad time to discover it. Turn the VPN on for foreign services, off for domestic payments. The payment setup guide covers what else to sort out ahead of arrival.
Frequently asked questions
Is a VPN legal for tourists in China?
Only government-approved VPN services are legal in mainland China; unapproved ones are non-compliant under the 2017 MIIT rules. Enforcement focuses on providers and commercial resale rather than individual travellers, and reported cases against short-stay tourists are very rare, but there is no published exemption for visitors. Use your own judgement, and note that a travel eSIM raises none of these questions.
Which VPN works in China in 2026?
Only services with genuine TLS obfuscation still connect dependably. WireGuard, OpenVPN, IKEv2 and Shadowsocks are detected and blocked by default; V2Ray is intermittent. Astrill, ExpressVPN, NordVPN, Surfshark and LetsVPN are each recommended first by different reviewers and none is stable for everyone. Bring two providers from different companies and enable the obfuscation mode on both.
Can I download a VPN after arriving in China?
No, in practice. Provider websites and app store listings for VPN apps are blocked on mainland networks, and payment from inside China adds another obstacle. Install the app, create the account, pay and test the connection before you leave home. This is the single most common trip mistake in this area.
Does a travel eSIM replace a VPN?
For your phone, yes. A travel eSIM with international routing carries your data out through a foreign carrier, so blocked apps work with no VPN app and no configuration. It does not replace a VPN for a laptop on hotel Wi-Fi, because the eSIM only serves the device it is installed in.
Do I need a VPN if I only use my phone?
Usually not. Buy a travel eSIM with Hong Kong or international routing, install it before you fly, and you have Google, WhatsApp, Instagram and Gmail on arrival. A VPN only becomes necessary if you carry a laptop, rely on hotel Wi-Fi, or want a second independent route in case one fails.
Will a free VPN work in China?
Do not count on it. Free services rarely offer obfuscated protocols, and it is exactly the standard protocols that are blocked. They are also usually oversubscribed and among the first to be identified, because their server addresses are public and well known. If you need a VPN in China, it needs an obfuscation mode.
Does the Great Firewall block WeChat, Alipay or DiDi?
No. Chinese services run on mainland infrastructure and work normally, which is why the trip is entirely possible without any workaround. The blocked list is foreign services: Google, Gmail, YouTube, WhatsApp, Instagram, Facebook and X. Your Chinese payment and transport apps will work on hotel Wi-Fi with no help at all.
Should I turn my VPN off when using Alipay or WeChat Pay?
Yes. A foreign IP address can look like unusual activity and trigger a risk check, which shows up as a declined payment. Keep the VPN on for foreign services and off for Chinese payments, ride-hailing and bookings. It takes a moment to toggle and saves a queue at the counter.
Is a VPN necessary in Hong Kong or Macau?
No. Both are outside the mainland filtering regime, so Google, WhatsApp and Instagram work on any connection there. If your VPN fails partway through a mainland trip, a day in Hong Kong or Macau is a reliable reset for anything you need to download or check.
My VPN connects but pages still will not load — why?
Usually the protocol is being partially detected: the tunnel opens but the traffic inside it is identified and dropped. Switch to the provider's obfuscation mode rather than retrying the same one, and if that fails, switch to the second provider. Repeatedly reconnecting on a blocked protocol tends to make the connection worse, not better.
Can I use a VPN on a work laptop in a Chinese hotel?
That is the case a VPN is for. Install it and test it at home, keep the obfuscation mode enabled, and have a second provider ready. Note that some corporate VPNs are blocked by category rather than by protocol, and you may not be permitted to install a personal client on a managed device — check with your IT team before you travel.
How reliable is a travel eSIM inside China?
It behaves like ordinary roaming: good coverage in cities and on the high-speed rail network, weaker in remote areas, where mainland coverage is weak in any case. The one thing worth checking before you buy is the routing. A plan that breaks out locally through the mainland network lands you behind the firewall, so confirm the plan page states international or Hong Kong routing.
Related reading
VPN performance in China changes month to month. This page is re-checked at the start of every month; the last verification date is shown at the top. Protocol behaviour is based on reported testing from inside mainland China plus provider documentation as of 28 September 2026. No VPN brand is endorsed here, no subscription prices are quoted, and no service can be described as reliably working; where sources disagree on ranking or on individual penalty amounts, both positions are stated. Confirm current terms with the provider and current policy with the official source before you rely on either.