VPNs and the Great Firewall of China
China runs the most capable national censorship system in the world. It blocks Google, most Western platforms and many news sites, and it is unusually aggressive at finding and blocking VPNs — not just by protocol fingerprint but by actively probing suspicious servers. This page explains how that works and why no VPN, including AVEE, can honestly promise it will connect in China. It is an explainer, not a product pitch.
AVEE VPN — a VLESS/Reality app for Android and Windows, with a free trial to test it on your own connection. See the apps and where it's available →
How the Great Firewall blocks VPNs
- IP and keyword blocking — known VPN server addresses and DNS entries are dropped or poisoned.
- Protocol fingerprinting — the opening bytes of WireGuard, OpenVPN and IPSec connections are recognised and cut. This is the deep-packet-inspection layer described in how ISPs block VPNs.
- Active probing — when the firewall sees traffic it suspects is a proxy, it connects to that server itself and tests how it responds. If the server does not behave exactly like a normal web service, it is blocked. Few other countries do this at scale.
- Timing and volume analysis — long, steady encrypted flows to a single endpoint stand out from normal browsing.
Why the Reality transport exists
The Reality transport (used with VLESS on the Xray core) was designed specifically against active probing. It makes a server borrow the TLS identity of a real, unblocked website, so a probe sees an authentic handshake, and any visitor without the right key is passed straight through to that real site. There is no separate domain or certificate to leak. The full explanation is on what is the Reality transport.
This is why Reality-based tools are discussed in the context of China at all. It raises the bar for detection. It does not remove IP blocking, throttling, or the firewall's ability to adapt.
Why no VPN can promise China access
Whether any given service connects in China changes week to week, sometimes day to day, and varies by city, network and time. A transport that works in the morning can be caught by an updated rule in the afternoon. Any site that tells you a particular VPN "always works in China" is overselling. The honest position is: some transports have a better chance than others, and the only way to know about yours is to test it on the connection you will actually use.
If you want to try AVEE
AVEE uses VLESS + Reality by default on Android and Windows. It makes no claim to work in China. If you want to check, the honest way is the free trial — about 1 GB for up to 3 days — on your own connection, ideally before you rely on it. Plans start at $1/month. Also read how we measure availability, which explains why an availability signal is guidance, not a guarantee.
AVEE uses VLESS/Reality and lets you test compatibility on your connection before paying.
FAQ
- Does AVEE work in China?
- We do not claim it does. AVEE uses VLESS + Reality, which is designed to resist the kind of detection China uses, but connectivity changes constantly and varies by network and city. Use the free trial to test your own connection.
- What is "active probing"?
- The censor connects to a server it suspects is a proxy and checks how it responds. If it does not behave like a normal web server, it gets blocked. The Reality transport is built to defeat this by presenting a real external site's TLS identity.
- Is it legal to use a VPN in mainland China?
- Only government-approved VPNs are authorised. Unauthorised VPN provision is penalised, and individual use sits in a grey area that has occasionally been enforced. This is general information, not legal advice.
Sources
- Top10VPN — VPN censorship methods, including active probing — checked 2026-08-29
- GreatFire — analyzer of blocking in China — checked 2026-08-29