8

I will soon be spending a few months travelling across China and want to get a VPN service to get around the Golden Firewall.

When I was in China in 2014/15 the general consensus was that Astrill offered the most reliable service, but I heard that they have been targeted quite strongly by the government over the last year.

Therefore, I am wondering what is the best VPN for China these days? Is Astrill still as good as it used to be?

Any recent experiences would be very helpful!

Improve this question
3

3 Answers 3

Reset to default
13

The most reliable VPN would be the one you host yourself at your home router. You might not get a very good speed, but it will be the most resilient against getting blocked.

To start, a bit of info how Chinese firewall works. Please note that it is mostly based on research, as there are obviously no official papers.

Every time you establish the connection outside China, the firewall probes the IP/port you're trying to connect to for services and content. The probes continue for some time, and the decision to block can be made (and usually is made) later. Depending on the services it is being run, the connection is:

  • Blocked immediately (this is the case for one of my nodes which runs a Tor relay);
  • Allowed temporarily (this is the case for one of my VPNs which also runs the mail server). This means the VPN may work for some time, and then stop working in 20-30 minutes. It will be working again in a few hours, but with the same pattern.
  • Allowed more or less permanently.

The way firewall blocks IPs is based on some rudimentary heuristics (i.e. we know for sure which activity would lead to a block, but we do not know which activity would guarantee lack of block). VPN servers seem to get blocked only when a large enough number of users connect to them; the block appears to be manual in this case as it always happens on different time intervals. Also OpenVPN tends to get blocked faster than PPTP (we suspect because Chinese cracked PPTP encryption).

Thus, to answer your question:

  1. There is not a single VPN provider which would be "the best" for long time. It could be "the best" right now, but it says nothing about its availability tomorrow. The firewall blocking nature is not predictable.

  2. A less known provider is a better choice than a well-advertized one (which could be blocked already). A provider which is used by many Chinese is probably a bad choice - higher chance for it to be on firewall's radar and get blocked.

So the second best solution would be to choose two different small providers (preferably one offering PPTP, and one offering OpenVPN). The best is to install your own VPN on your home machine, or rent a server if you know how to do it.

And if you run OpenVPN, make it listen to a non-standard port (port 30 is a good choice because the firewall can't make any assumptions on what's listening there).

PS. If you run ssh on the same server, expect it to be brute-forced for passwords shortly after your first connection by a bunch of different Chinese IPs nonstop; disable password authentication altogether.

Improve this answer
4
  • Everybody cracked PPTP encryption. It's so broken that you can crack it on an ordinary PC in a few minutes. It is like nothing to the GFW.
    – Michael Hampton
    Commented Oct 4, 2016 at 1:01
  • 1
    AFAIK only the initial handshake could be cracked "on an ordinary PC in a few minutes", but this will give you a key which has to be cracked too to decrypt the traffic. It would take a day on an FPGA box. At least this was from DefCon 2012.
    – George Y.
    Commented Oct 4, 2016 at 1:43
  • 1
    @pnuts: you asking about PPTP cracking? A quick search couldn't find any updated recent research.
    – George Y.
    Commented Oct 4, 2016 at 4:35
  • I was looking on that too, but still wanted to suggest having our own VPN server beats all those options.
    – George Y.
    Commented Oct 4, 2016 at 4:41
3

The easiest way, though not always the cheapest, for a foreigner to evade the Great Firewall on a reasonably short trip to Mainland China is to avoid local wi-fi and connect to the Internet through a foreign cellphone roaming on Chinese carriers. When you do this, your data will go through an encrypted tunnel to your home carrier, bypassing Chinese filtering, and then connect to the rest of the Internet from there.

If your home carrier is cost-prohibitive or too slow to use in this way, it may be possible to use a Hong Kong SIM card for this purpose. The connection between mainland China and Hong Kong is quite fast, and many operators offer plans with reasonably affordable roaming in the mainland for exactly this purpose. The prepaid with data wiki has some information about these options, though the exact offers change frequently and the wiki may be out of date. Note that you must set up your plan before entering China, either at a stopover in Hong Kong or (sometimes) by mail order in advance; you will not be able to get a Hong Kong SIM card delivered to you in the mainland.

Improve this answer
1
  • e-sim is also an option if your device supports it.
    – xngtng
    Commented Aug 4, 2023 at 11:35
2

If you're a bit tech-savvy and willing to invest in a private server (whether a regular shared hosting or a cloud instance), have a look at a great blog post detailing how to evade China's VPN filter. There are also several open-source projects that can help:

  • Streisand - automatically sets up an obfuscated VPN server and other helpful tools on any machine

  • SoftEther VPN - another obfuscated VPN software project

  • Obfsproxy an obfuscating wrapper over any OpenVPN

Overall it seems that it's best to have 2-3 private VPN servers set-up and tested before you travel to China in order to guarantee a stable VPN connection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .