The Great Firewall blocks most VPNs using deep packet inspection. These five picks — from Astrill's StealthVPN to free self-hosted Outline — use obfuscation to get through. Here's how they compare.
The Great Firewall (GFW) doesn't just block websites — it actively detects and throttles VPN traffic using deep packet inspection (DPI). Standard OpenVPN and WireGuard connections are routinely identified and disrupted, which is why a VPN that works fine in Europe or North America may be useless the moment you land in Beijing.
The workaround is obfuscation: protocols that disguise VPN traffic as ordinary HTTPS web traffic, making it much harder for the GFW to distinguish from normal browsing. This is the single most important feature to look for when choosing a VPN for China.
Install your VPN before you arrive. VPN provider websites are themselves blocked inside China, so downloading or subscribing once you're already there can be difficult. Set everything up at home, test it, and carry a backup option.
Astrill has been the go-to VPN for China expats and business travelers for years. Its proprietary StealthVPN protocol is explicitly designed to bypass government firewalls1, and the company has a long track record of staying ahead of GFW updates.
At roughly $9 per user per month1, it's not cheap — but if reliable connectivity is non-negotiable (business calls, remote work, accessing corporate tools), Astrill is the most battle-tested commercial option.
Best for: expats, business travelers, anyone who needs maximum reliability.
LetsVPN is optimized specifically for the Chinese Great Firewall, prioritizing connectivity and ease of use2. Its China-optimized protocols are tuned for high stability in restricted zones2, and the setup process is about as simple as it gets.
At a mid-range price point, it's a strong pick for short-term travelers who want something that works without fiddling with settings.
Best for: casual travelers, first-time VPN users, short trips.
ExpressVPN's Lightway protocol includes built-in obfuscation, and the service is widely regarded for its ease of use, high speeds, and strong privacy policy across a wide range of devices3. Its global server coverage means you can connect from many locations, and the apps are genuinely beginner-friendly.
It's a premium-priced option, but it's also the most versatile pick here — equally good for China travel and everyday use back home.
Best for: travelers who want one VPN for everything, not just China.
Outline (by Jigsaw/Google) is a free, Shadowsocks-based VPN designed to evade censorship4. You deploy it on your own cloud server using the Manager app, which can set up a server on most cloud providers in minutes4. You then distribute access keys to your devices.
There's no subscription — you only pay for whatever cloud server you use — and because it's Shadowsocks-based, it's inherently resistant to DPI. The trade-off is that you need comfort with cloud hosting and self-management.
Best for: tech-savvy travelers who want full control and zero recurring VPN fees.
AmneziaVPN is another free, self-hosted option, but with a broader protocol toolkit. It uses a client-driven approach to automatically install and configure various VPN protocols on your VPS via SSH5, with anti-censorship obfuscation and DPI bypass built in5.
The one-click deployment makes it slightly more approachable than Outline for some setups, and multi-protocol support means you can switch approaches if one gets blocked.
Best for: advanced users who want protocol flexibility and DPI bypass without paying.
| Obfuscation | Setup | Price | |
|---|---|---|---|
| Astrill | StealthVPN (proprietary) | Moderate | ~$9/mo |
| LetsVPN | China-optimized protocols | Very easy | Mid-range |
| ExpressVPN | Lightway + obfuscation | Very easy | Premium |
| Outline | Shadowsocks-based | Requires VPS | Free (self-hosted) |
| AmneziaVPN | DPI bypass + multi-protocol | One-click VPS deploy | Free (self-hosted) |
Astrill, LetsVPN, and ExpressVPN are commercial services — you pay a subscription and they handle server infrastructure, protocol updates, and support. This is the right choice for most travelers: when the GFW updates its detection methods, these companies push fixes to their apps.
Outline and AmneziaVPN are self-hosted — you run the server yourself. The upside is cost (you only pay for cloud hosting) and control. The downside is that when the GFW changes tactics, you're the one who has to update or reconfigure. For a short trip, commercial is simpler. For long-term residency with technical skills, self-hosted gives you independence.
Both are China-focused, but they target different users. Astrill is the premium, business-grade option with a proprietary protocol and a long track record1. LetsVPN is the simpler, more affordable choice optimized for connectivity and ease of use2. If you're on a business trip and can't afford downtime, Astrill. If you're a tourist who just wants WhatsApp and Google Maps, LetsVPN.
AskBuy may earn a commission when you sign up through links on this page. Self-hosted options (Outline, AmneziaVPN) are free software — you only pay for your own cloud server.
This page was written by the engine and the engine is still on the line. The conversation below picks up where the article stops.
Yes — the picks above are the engine's current verdicts. Ask a sharper version of this question below and you'll get a custom answer with the latest pricing.