Every China packing list says the same thing: get a VPN before you fly. It's advice worth re-reading in 2026, because both halves of it changed this year — which services survive, and what happens to the people using them. Here's where things actually stand, and why the question may not be the one you need to answer.
What changed in 2026
Two things, and the second one is the one nobody saw coming.
The infrastructure got unplugged. Around the start of April, reports circulating on Chinese social media described what users nicknamed the great unplug (拔线潮): relay servers sitting in domestic data centres physically disconnected from their racks. Self-hosted proxy setups — Shadowsocks, V2Ray, Trojan and friends — went dark en masse, including for people holding paid annual subscriptions.
Around the same time, China Digital Times published a set of purported leaked notices, including a 31 March memo attributed to Shaanxi Telecom instructing that all IP addresses under its jurisdiction block access outside the mainland, and an April meeting notice convening the three big state carriers on unauthorised cross-border connections. The documents weren't independently verified, though CDT reported receiving corroborating notices from other sources. The target appears to be commercial circumvention operators rather than end users.
Detection got better. The practical upshot for travellers is that plain OpenVPN and stock WireGuard are now heavily fingerprinted — the firewall doesn't need to read your traffic to recognise the shape of it. Only tools that disguise their traffic as ordinary encrypted web browsing tend to survive between outages.
What travellers report still works
Reviewers who test from inside the mainland converge on a short list: Astrill's StealthVPN, ExpressVPN's Lightway, NordVPN's obfuscated servers, and Surfshark's Camouflage Mode.
Read that as a snapshot, not a recommendation. Three caveats, and they matter more than the names:
- Almost every "best VPN for China" page earns a commission on the link you click. That doesn't make them wrong, but it does mean nobody in that market is incentivised to tell you the category is unreliable.
- Nobody can promise next month. Access tightens around politically sensitive dates and major political meetings, and a service that sailed through in June can be a coin flip in October.
- Working isn't the same as pleasant. Obfuscation costs speed and battery, and video calls over a strained tunnel are their own kind of misery.
The legal line moved
This is the genuinely new part. Operating an unlicensed VPN in China has long been illegal, but individual use sat in a tolerated grey zone — enforcement went after developers and commercial operators.
In March 2026 that changed. Police in the Hubei cities of Ezhou and Xiaogan pursued ordinary users: one man was fined 200 yuan (roughly $27) for using a proxy tool to reach TikTok and X, another 500 yuan (roughly $69) following a search of his home. Both received formal warnings ordering them to cease unauthorised international networking.
Two things to hold at once. Those cases involved Chinese residents, and there are no publicly reported cases of a foreign visitor being fined or detained for personal VPN use. But "no reported cases" is not a guarantee, the enforcement posture is visibly tightening, and none of this is legal advice.
The trap in the advice itself
Even setting all that aside, "get a VPN" has a logic problem: you can't fix it from inside. Unauthorised VPN apps were removed from the Chinese App Store in 2017, and provider websites are routinely unreachable from the mainland. If your app fails its first real test at passport control, the tool you'd use to fix it is behind the thing that's blocking you.
The setup that skips the question
The filtering applies to traffic that enters the internet as a Chinese local connection — a local SIM, home broadband, café Wi-Fi. A VamosData eSIM for China works like international roaming: your phone uses the local radio network, but your data exits through a gateway outside the mainland, commonly Hong Kong or Singapore. It was never a local connection, so it isn't filtered like one.
That's not a loophole — it's the same ordinary roaming a business traveller uses on their home operator. What it buys you is the absence of moving parts:
- No app to install, test, or troubleshoot at the worst possible moment.
- Nothing to renew or replace when a protocol stops working next quarter.
- Your home number stays live on your existing SIM for calls and bank codes, while your VamosData eSIM carries the data.
One honest caveat: routing is set by each plan's network partner, so if a specific app is mission-critical, check the plan details before you rely on it.
Where a tunnel still earns its place
Being straight about the limits: the moment you join hotel or café Wi-Fi, you're on a local connection again and behind the filter, whichever SIM is in your phone. If you'll be working from hotel Wi-Fi for weeks, a VPN is still worth having — installed and tested at home. For a two-week trip where the data lives on your phone, staying on mobile data covers it.
Check your handset supports eSIM with the device checker — note that phones sold in mainland China often ship with it disabled — then see what's available on destinations. For how the filtering works under the hood, read China's Great Firewall, explained; for the full pre-flight checklist, how to get internet on your phone in China.