Skip to content
China Travel Guide

Why ExpressVPN and Surfshark Don't Work Reliably in China and What to Use Instead

Connection problem on laptop screen

ExpressVPN and Surfshark fail in China because they lack specialized obfuscation technology that hides VPN traffic from Deep Packet Inspection. The Great Firewall detects their standard VPN protocol signatures within seconds and terminates connections.

For reliable access, use VPNs with obfuscation: Astrill’s StealthVPN, Mullvad’s Shadowsocks bridges, or NordVPN’s obfuscated servers.

How the Great Firewall Detects VPNs

The Great Firewall does not just block website URLs. It actively hunts for VPN protocol signatures.

Deep Packet Inspection (DPI) systems analyze traffic patterns. Standard VPN protocols have recognizable characteristics:

  • WireGuard: Distinctive 148-byte/92-byte handshake pattern that DPI detects immediately
  • OpenVPN: Recognizable TLS handshake signatures on non-standard ports
  • IKEv2: Protocol-specific packet sizes and timing patterns

KookVPN explains: WireGuard has a “specific ‘shape’” that DPI inspectors are “trained to recognize…and block permanently.” The handshake message is always exactly 148 bytes, creating a fingerprint that Chinese firewalls easily detect.

Why ExpressVPN and Surfshark Fail

These VPNs are designed for the global mass market. They prioritize:

  • Easy one-click setup
  • Large server networks
  • Streaming optimization
  • Marketing and affiliate partnerships

They do not invest in specialized obfuscation technology for a niche market like China. VPN Leaderboard states: “The vast majority of big-name VPNs…do not work reliably in China” because they are “too big and too generic.”

The GFW “actively hunts for and blocks the protocols that VPNs use.” Without obfuscation, standard protocols are detected and blocked.

The Affiliate Review Site Problem

VPN review sites often recommend ExpressVPN and Surfshark for China. Tom’s Guide lists ExpressVPN as a top pick. But real users report different experiences.

VPN Leaderboard explicitly warns: “Most VPN review sites are lying to you.” Affiliate commissions drive recommendations. VPNs with high commission rates get promoted regardless of actual China reliability.

A newly arrived graduate student tried to show a photo on Instagram using “a VPN with a slick YouTube sponsorship and a permanent 80 percent off deal” (likely ExpressVPN). Their phone was stuck on “Connecting…” screen. A colleague using Astrill VPN connected instantly.

Real testing contradicts marketing claims.

What Obfuscation Technology Does

Obfuscation makes VPN traffic look like normal HTTPS web browsing:

  • Uses TCP on port 443 (standard HTTPS port)
  • Presents valid TLS certificates (like microsoft.com or apple.com)
  • Traffic fingerprint matches real browser HTTPS connections
  • Indistinguishable from regular web traffic to DPI systems

VLESS+Reality protocol, tested by KookVPN, has about 98 percent success rate because it mimics TLS 1.3 HTTPS traffic exactly. Standard WireGuard has about 45 percent success rate because its distinctive pattern is easily detected.

VPNs That Actually Work

Astrill VPN

Astrill’s proprietary StealthVPN protocol was specifically designed for China. It uses TCP on port 443 and presents authentic TLS certificates.

Pros:

  • Most reliable VPN for China
  • Proprietary obfuscation designed for adversarial networks
  • Works consistently on Windows laptops

Cons:

  • Higher pricing than mainstream VPNs
  • Requires manual configuration for best performance
  • Website may be blocked inside China (subscribe before traveling)

Mullvad VPN with Bridge Mode

Mullvad requires manual configuration of Shadowsocks or V2Ray bridges. This gives you control over obfuscation settings.

Pros:

  • Open-source obfuscation technology
  • No email or personal information required for account
  • Works reliably when properly configured

Cons:

  • Requires technical setup knowledge
  • Not as simple as one-click VPN apps
  • Fewer server locations than mainstream VPNs

NordVPN with Obfuscated Servers

NordVPN works about 95 percent of the time when you enable obfuscated servers. You must manually select these servers.

Pros:

  • Large server network including Hong Kong and Taiwan
  • Kill switch feature for connection drops
  • Works reliably with correct settings

Cons:

  • Must manually enable obfuscated servers (not automatic)
  • Performance may slow during peak hours
  • Some servers may be temporarily blocked during crackdown periods

Pre-Travel Setup Checklist

VPN websites are blocked inside China. Complete all setup before you arrive:

  1. Download VPN apps for your laptop and phone
  2. Subscribe and activate your account
  3. Test connection from your home country
  4. Configure obfuscation settings (obfuscated servers, StealthVPN, bridges)
  5. Save server lists and configuration files offline
  6. Install at least 2 backup VPN apps from different providers

If you are already in China and cannot access VPN websites, hotel WiFi sometimes has less aggressive filtering than residential ISPs. Try downloading through hotel network first.

Common Mistakes When Choosing VPN for China

Trusting Review Site Recommendations

Most VPN review sites prioritize affiliate commissions over accuracy. VPN Leaderboard warns that mainstream review sites “recommend unreliable VPNs” because of “affiliate commission incentives.”

Using Free VPNs

VPN Security Blog: “Free VPNs don’t work. Budget VPNs rarely work.” Save time by subscribing to a VPN with proven obfuscation.

Not Enabling Obfuscation

NordVPN users often forget to enable obfuscated servers. Without this setting, NordVPN behaves like other mainstream VPNs and fails in China.

Expecting Mobile VPN to Work on Laptop

Many VPN apps only work on phones. Check if your VPN provider has a PC version before assuming laptop support.

Summary

ExpressVPN and Surfshark fail in China because they lack obfuscation technology. The Great Firewall detects their standard protocol signatures and blocks connections.

For reliable VPN access:

  • Use Astrill VPN with StealthVPN protocol
  • Configure Mullvad with Shadowsocks bridges
  • Enable NordVPN obfuscated servers manually

Set up everything before you arrive in China. VPN websites are blocked. Ignore affiliate review site recommendations. Test from home before traveling.

Final words

More reading and next steps

Continue reading

Related posts

That is the main thread of the article. Keep the links below handy, and use the related posts to continue exploring the same topic from a different angle.

References and links

Comments