6

I will soon be spending a few months travelling across China and want to get a VPN service to get around the Golden Firewall.

When I was in China in 2014/15 the general consensus was that Astrill offered the most reliable service, but I heard that they have been targeted quite strongly by the government over the last year.

Therefore, I am wondering what is the best VPN for China these days? Is Astrill still as good as it used to be?

Any recent experiences would be very helpful!

Improve this question
3

3 Answers 3

Reset to default
12

The most reliable VPN would be the one you host yourself at your home router. You might not get a very good speed, but it will be the most resilient against getting blocked.

To start, a bit of info how Chinese firewall works. Please note that it is mostly based on research, as there are obviously no official papers.

Every time you establish the connection outside China, the firewall probes the IP/port you're trying to connect to for services and content. The probes continue for some time, and the decision to block can be made (and usually is made) later. Depending on the services it is being run, the connection is:

  • Blocked immediately (this is the case for one of my nodes which runs a Tor relay);
  • Allowed temporarily (this is the case for one of my VPNs which also runs the mail server). This means the VPN may work for some time, and then stop working in 20-30 minutes. It will be working again in a few hours, but with the same pattern.
  • Allowed more or less permanently.

The way firewall blocks IPs is based on some rudimentary heuristics (i.e. we know for sure which activity would lead to a block, but we do not know which activity would guarantee lack of block). VPN servers seem to get blocked only when a large enough number of users connect to them; the block appears to be manual in this case as it always happens on different time intervals. Also OpenVPN tends to get blocked faster than PPTP (we suspect because Chinese cracked PPTP encryption).

Thus, to answer your question:

  1. There is not a single VPN provider which would be "the best" for long time. It could be "the best" right now, but it says nothing about its availability tomorrow. The firewall blocking nature is not predictable.

  2. A less known provider is a better choice than a well-advertized one (which could be blocked already). A provider which is used by many Chinese is probably a bad choice - higher chance for it to be on firewall's radar and get blocked.

So the second best solution would be to choose two different small providers (preferably one offering PPTP, and one offering OpenVPN). The best is to install your own VPN on your home machine, or rent a server if you know how to do it.

And if you run OpenVPN, make it listen to a non-standard port (port 30 is a good choice because the firewall can't make any assumptions on what's listening there).

PS. If you run ssh on the same server, expect it to be brute-forced for passwords shortly after your first connection by a bunch of different Chinese IPs nonstop; disable password authentication altogether.

Improve this answer
4
  • Everybody cracked PPTP encryption. It's so broken that you can crack it on an ordinary PC in a few minutes. It is like nothing to the GFW.
    – Michael Hampton
    Oct 4, 2016 at 1:01
  • 1
    AFAIK only the initial handshake could be cracked "on an ordinary PC in a few minutes", but this will give you a key which has to be cracked too to decrypt the traffic. It would take a day on an FPGA box. At least this was from DefCon 2012.
    – George Y.
    Oct 4, 2016 at 1:43
  • 1
    @pnuts: you asking about PPTP cracking? A quick search couldn't find any updated recent research.
    – George Y.
    Oct 4, 2016 at 4:35
  • I was looking on that too, but still wanted to suggest having our own VPN server beats all those options.
    – George Y.
    Oct 4, 2016 at 4:41
2

If you're a bit tech-savvy and willing to invest in a private server (whether a regular shared hosting or a cloud instance), have a look at a great blog post detailing how to evade China's VPN filter. There are also several open-source projects that can help:

  • Streisand - automatically sets up an obfuscated VPN server and other helpful tools on any machine

  • SoftEther VPN - another obfuscated VPN software project

  • Obfsproxy an obfuscating wrapper over any OpenVPN

Overall it seems that it's best to have 2-3 private VPN servers set-up and tested before you travel to China in order to guarantee a stable VPN connection.

Improve this answer
1

Here are the list Of Best VPN for China October 2016 But i suggest you go for expressVPN this is the only vpn works perfect on china

Improve this answer
1
  • Thanks. We refrain from link-only answers, could you maybe copy the most important info to here? Also do you have any affiliation with the linked site and the recommended service? That would be fine but you need to disclose it.
    – mts
    Oct 8, 2016 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .