Short answer: Google Search, Gmail, Maps, Drive, YouTube and the Play Store are all blocked on every network in mainland China. That includes the three state carriers (China Telecom, China Unicom and China Mobile), hotel Wi-Fi and local eSIMs. Google pulled its search engine out of the mainland in 2010, and the Great Firewall (GFW) has blocked its services since then. Visitors get around the block with a VPN that disguises its own traffic. Plain VPNs have not worked reliably for years. Below is which protocols still work, why, and what to set up before you fly.
Hong Kong and Macau are not behind the GFW. Google works normally there. Roaming on a foreign SIM usually works too, because the data is routed back to your home carrier.
How the Great Firewall blocks Google
The GFW is not a single block list. It is several layers, and each one defeats a different kind of workaround:
- DNS poisoning. When your device asks for
google.com, the GFW injects a fake answer. That is why changing your DNS server alone does nothing. - IP blocking. Google's IP ranges are null-routed. Even with the right address, the packets go nowhere.
- SNI filtering. Every HTTPS connection announces the site name in plain text at the start of the handshake, and the GFW resets connections that name Google domains. Encrypted SNI (ESNI) was blocked outright in 2020, so hiding the name is not an option either.
- Protocol fingerprinting. The GFW recognises the opening handshakes of standard VPN protocols. OpenVPN and plain WireGuard are identified within seconds and blocked or throttled.
- Detection of fully encrypted traffic. Since late 2021, the GFW has also blocked connections that look like random bytes from the first packet onward, which is the signature of Shadowsocks-style proxies. This was documented by researchers in "How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic" (USENIX Security 2023).
- Active probing. When the GFW suspects a server, it connects to that server itself to check whether it behaves like a proxy. If it does, the server's IP is blocked for everyone.
Taken together, this means a VPN has to do more than encrypt. It has to look like something the GFW is not willing to block, and keep looking like it when the GFW probes the server.
The 2026 shortlist: protocols ranked by how well they hold up
1. Reality (VLESS + Reality, via Xray or sing-box): best current option
Reality makes the connection look like a real HTTPS visit to a real, popular non-Chinese website. It uses that site's actual TLS handshake, so the browser-style fingerprint is genuine. If the GFW probes the server, it is passed straight through to the cover site and sees a legitimate certificate. This answers SNI filtering, fingerprinting and active probing at the same time. Weakness: traffic patterns over a long session can still stand out, and a server IP that attracts attention can be blocked regardless.
2. AmneziaWG: fast, works on many networks
AmneziaWG is WireGuard with the fingerprint removed. It adds junk packets before the handshake and changes the fixed header bytes. It defeats signature-based WireGuard blocking and is much faster than TLS-based tunnels. Weakness: it runs over UDP, and some Chinese networks deprioritise or cut long-lived UDP flows to foreign IPs, especially at busy times and around sensitive dates. Treat it as the fast option and Reality as the dependable one.
3. VMess / Trojan over WebSocket + TLS: older, still works
These tunnel traffic inside a normal TLS connection to a real domain, often behind a CDN. They still work, but they rely on a domain and certificate that you own, which gives the GFW something to block, and the TLS fingerprint is usually not a perfect match for a browser. Still usable, but being phased out in favour of Reality.
4. OpenVPN: mostly blocked
OpenVPN is recognised by fingerprint, including on TCP 443. It is listed here only for completeness. Don't rely on it.
5. Plain WireGuard: gone
WireGuard's fixed 148-byte handshake is trivial to match. On most mainland networks it has been unusable since 2024–2025.
Comparison
Protocols against GFW techniques:
| Protocol | DNS / IP block | SNI filter | Fingerprint | Encrypted-traffic heuristic | Active probing |
|---|---|---|---|---|---|
| Reality | ✅ | ✅ (cover site's SNI) | ✅ (real TLS) | ✅ (it is TLS) | ✅ (probe sees cover site) |
| AmneziaWG | ✅ | n/a (no TLS) | ✅ | ⚠️ partial | ⚠️ partial |
| VMess/Trojan + WS + TLS | ✅ | ⚠️ own domain | ⚠️ library fingerprint | ✅ | ⚠️ |
| OpenVPN | ✅ | n/a | ❌ | n/a | ❌ |
| WireGuard | ✅ | n/a | ❌ | n/a | ❌ |
What the main providers publicly offer for China (taken from each vendor's own documentation, not from our testing):
| Provider | Disguised protocol(s) | China-specific guidance |
|---|---|---|
| Astrill | StealthVPN, OpenWeb (proprietary) | Yes, long a China-first provider |
| ExpressVPN | Lightway, with obfuscation applied automatically | Yes |
| NordVPN | Obfuscated servers (OpenVPN-based) | Yes, via obfuscated servers |
| Mullvad | WireGuard over UDP-over-TCP, Shadowsocks or QUIC (QUIC since Sept 2025, desktop first) | Not marketed for China |
| Unblock Master | Reality ("Unblocker") + AmneziaWG ("Faster") | Yes |
Methodology note: the second table lists only what each provider states publicly. Our automated tester connects to each of our own servers every 15 minutes and alerts on failures. We don't publish reliability numbers for other providers, because we can't measure them the same way.
Setting it up
With Unblock Master:
- Install the app before you enter mainland China. The App Store in China does not list VPN apps, and VPN websites are blocked. Install it at home, sign in and test.
- Use Unblocker (Reality) as your default in China. Switch to Faster (AmneziaWG) for video calls or big downloads when it connects, and switch back if it stalls.
- Pick a server close to China, such as Hong Kong, Japan or Singapore. Lower latency makes a big difference through the GFW.
- Check it works with our VPN checker, then open Google.
Self-hosting instead: if you run your own server, Xray or sing-box with VLESS + Reality on port 443 is the current standard setup. Use a popular, non-Chinese HTTPS site that supports TLS 1.3 as the cover destination, and keep a second server in reserve.
Honest limitations
No VPN is 100% reliable in China, and anyone who claims otherwise is selling something. Expect these:
- Sensitive dates (early June, the October National Day period, major party meetings) bring wider throttling. Even good setups slow down or drop for hours.
- Server IPs get burned. A server that draws GFW attention can be blocked even when the protocol is undetectable. We rotate IPs when that happens. Self-hosters have to do it manually.
- Our own record: our tester connects to every server every 15 minutes and pages us when one fails, and failing servers get restarted or replaced. We don't yet publish a historical uptime percentage, and we won't quote one until we can show how it was measured.
FAQ
Do I need a Chinese ID to use Google in Shanghai? No. Your VPN connection doesn't depend on your ID. A local SIM card does need passport registration, though, and a local SIM is filtered like any Chinese connection.
Is the Google Play Store blocked too? Yes. Install every Android app you'll need before you go. Most Chinese Android phones ship without Google Play services at all.
How do people in mainland China reach Google? The same way: self-hosted or commercial Reality/Xray-style proxies, usually set up through clients like Clash, v2rayN or sing-box. Mainland App Store accounts can't download VPN apps, so locals rely on foreign accounts or on sideloading.
Is using a VPN in China illegal for visitors? Using an unapproved VPN is technically prohibited for everyone, visitors included. In practice, enforcement targets sellers and providers, and there are no verified reports of tourists being arrested only for using a VPN. "Rare" is not "never", though, so be discreet. International roaming avoids the question entirely, because your data is routed through your home carrier.
Get Unblock Master VPN before you go. It installs from any non-China Apple ID or Google account. Mainland App Store accounts can't download it. 7-day free trial. App Store · Google Play
Related: How VPNs get blocked · VPN protocols compared
