VPN Protocols That Actually Work in China: VLESS+REALITY, Hysteria2 & (2026)

In September 2021, the Great Firewall switched on a new detection system, and within months it broke a workaround that had lasted close to a decade. Shadowsocks, the lightweight proxy that a generation of expats and students used to reach Google, started failing connection by connection. The researchers who track the firewall, the GFW Report team, published their findings at USENIX Security in 2023. They showed that the censor had stopped waiting for someone to report a proxy. It was fingerprinting encrypted handshakes in passing and blocking the servers on its own, at industrial scale.

That shift is why a protocol list from 2023 can be flat-out wrong in 2026. The firewall learns. Anything you read about “the best protocol for China” has an expiry date. Here is the current state, based on published research and the official protocol documentation, verified against the sources linked at the bottom as of 2026-08.

How the firewall catches encrypted proxies

Two mechanisms do most of the work.

Passive fingerprinting. Deep packet inspection systems sit on the international links and look at the shape of your first few packets. Every proxy protocol has a tell. Shadowsocks opens with a distinctive AEAD encryption pattern. OpenVPN starts with a fixed opcode and key exchange. WireGuard’s initiation message is 148 bytes and looks like nothing else on the internet. The USENIX 2023 paper documented the GFW using exactly this approach to detect and block fully encrypted traffic in real time, with no human in the loop.

Active probing. When the firewall suspects a server, it connects to it with crafted packets and watches how the server answers. A normal web server answers like a web server. A proxy answers like a proxy. Researchers first documented this against Tor bridges in 2015 (Ensafi et al., at ACM IMC). The same technique now runs continuously against VPN infrastructure. A server that fails the probe gets its IP blacklisted, sometimes within minutes.

The design lesson follows directly: to survive, your traffic has to look like something the GFW cannot afford to block.

What no longer works

Shadowsocks. Created in 2012, it was the default answer for a decade. The GFW began reliably fingerprinting its handshake in September 2021, per the GFW Report’s measurements. Forks like ShadowsocksR and wrappers like Outline held on longer, but standalone Shadowsocks should be considered dead inside China.

OpenVPN. Its protocol signature is fixed and public. The firewall detects it instantly. Wrapping OpenVPN in stunnel (TLS tunneling) makes it work again, but you are rebuilding, badly, what modern protocols do natively.

L2TP/IPsec and PPTP. Blocked at the protocol level for years. These are the enterprise VPN standards your office probably uses. Assume they will not connect from China, and confirm with your IT department before you travel if remote work depends on them.

Bare WireGuard. WireGuard is a great protocol: roughly 4,000 lines of code, merged into the Linux kernel in version 5.6 in 2020, fast and auditable. None of that helps against a fingerprint. Its UDP handshake on a fixed port is trivially recognizable, and the GFW blocks plain WireGuard servers routinely.

Plain QUIC with a real server name. This one is newer and catches people out. According to GFW Report research published at USENIX Security 2025, since April 2024 the firewall has been able to read the SNI field (the requested hostname) inside QUIC handshakes and block connections to targeted domains. QUIC is the UDP-based transport behind HTTP/3, so this matters for every modern proxy built on it. The fix is to hide or randomize the SNI, which brings us to what does work.

What still works as of August 2026

VLESS + REALITY (Xray)

VLESS is a lightweight proxy protocol in the Xray ecosystem (Xray is the actively maintained fork of V2Ray). REALITY shipped in Xray in early 2023, and it is the feature that changed the game.

Here is the trick. A normal TLS proxy serves its own certificate, and a self-issued or small-CA certificate is an easy tell: real traffic to big sites carries certificates from big issuers. REALITY instead points your server at a “destination” site, say www.microsoft.com, and proxies the TLS handshake with that site in real time. Your client receives Microsoft’s actual certificate, issued to Microsoft, because the handshake genuinely happened with Microsoft. Your data still routes through your proxy.

Now put yourself on the firewall’s side of the wire. Active probing gets a perfect TLS server, because there is one. Passive inspection sees a TLS 1.3 session with a valid, famous certificate. To tell your proxy apart from a real visit to Microsoft, the GFW would have to block or decrypt connections to Microsoft. It will not do that, because the economic damage of breaking TLS to major foreign companies would be enormous.

Setup sits at medium-high difficulty. You rent a VPS outside China (roughly $4-10/month from the usual budget providers), install Xray, write a config that names a destination site with TLS 1.3 and HTTP/2 support, and install a client: v2rayN on Windows, v2rayNG on Android, sing-box or Hiddify elsewhere. REALITY runs over TCP, typically port 443.

Hysteria2

Hysteria 2’s own documentation describes it as a censorship-circumvention proxy built on a customized version of QUIC. Two details matter for China.

First, its “Brutal” congestion control. Instead of politely backing off when packets get dropped, Brutal aims for a user-defined target bitrate and keeps hammering. On lossy hotel and airport WiFi, traveler reports consistently put it ahead of TCP-based proxies for throughput. Some community benchmarks put it 30-50% faster than VLESS+REALITY on downloads, though your server’s bandwidth is the real ceiling.

Second, obfuscation. Hysteria2 supports an obfs mode called Salamander that encrypts the QUIC header with a key derived from a password you set. To anything watching, your packets look like random UDP on port 443. There is no SNI in the clear, which sidesteps the April 2024 QUIC censorship documented by the GFW Report researchers. Random-looking UDP is hard to block selectively, so the firewall mostly leaves it alone.

Setup is the easiest of the three: a server install script, one config file, and a client (sing-box, Hiddify, or the official Hysteria2 app). Medium difficulty overall.

WireGuard, only with a wrapper

Since plain WireGuard dies on contact, the survival strategy is to bury it. Two approaches see real use:

• udp2raw wraps WireGuard’s UDP packets inside fake TCP headers with an obfuscation password. The firewall sees ordinary-looking TCP. The cost is the classic TCP-over-TCP penalty: when packets drop, both layers retransmit, and throughput suffers.
• QUIC wrappers are the newer direction. In September 2025, Mullvad shipped QUIC obfuscation for WireGuard (part of its Daita feature), tunneling WireGuard inside QUIC that presents as HTTPS/3. It is a useful signal that a mainstream provider now considers raw WireGuard unviable against national firewalls and is re-wrapping it.

Setup is medium, with the extra tunnel adding one more thing that can break.

Protocol comparison

Status reflects published research and community testing as of 2026-08. The GFW changes continuously, so treat this as a snapshot, not a guarantee.

Commercial VPNs ride the same ideas

The providers that still work inside China have all converged on the strategies above: proprietary obfuscation layers over WireGuard or custom transports. What each claims to run is verifiable on its own site.

| Provider | Transport | Notes | |---|---|---| | Astrill | StealthVPN (proprietary, obfuscated) + WireGuard mode | Longest track record inside China in traveler reports | | ExpressVPN | Lightway (proprietary, built on wolfSSL) | Consistent obfuscation; shared IPs get blocked in waves | | Surfshark | WireGuard + Camouflage / NoBorders mode | Works when obfuscated servers are selected | | NordVPN | NordLynx (WireGuard-based) + obfuscated servers | Hit or miss inside China by traveler accounts | | Mullvad | WireGuard + Daita QUIC obfuscation (since Sept 2025) | Low profile; not China-marketed |

One caution: shared IP ranges get blocked in batches, so a provider that works in Beijing this month can stumble during a sensitive anniversary or a party congress next month. Check recent traveler reports from the past few weeks, not vendor marketing pages, before you commit.

Self-hosted vs commercial

| | Self-hosted (VPS + Xray or Hysteria2) | Commercial VPN | |---|---|---| | Cost | Roughly $4-10/month for the VPS | Roughly $8-15/month, less on long plans | | Reliability | High: your own IP, not on any blocklist | Medium: shared IPs get burned in batches | | Skill needed | High: server setup, configs, debugging | Low: install the app, sign in, connect | | Speed | High: dedicated bandwidth | Medium: shared bandwidth | | Failure mode | Your IP eventually blocked; you migrate to a new one | Provider rotates IPs; you wait it out |

For a two-week trip, commercial wins on simple math. The hours you would spend learning Xray configs are not worth saving $50. For a multi-year stay, self-hosting starts to pay off, and the reliability edge of a personal IP is real.

The legal part, stated plainly

In January 2017, the Ministry of Industry and Information Technology issued a notice launching a cleanup of the internet access market (notice No. 32 of 2017). It banned enterprises from setting up or renting cross-border lines, including VPNs, without official approval, and the enforcement campaign ran through March 31, 2018. You can read the full notice in English translation at chinalawtranslate.com, and you should verify the current text there as of 2026-08 before relying on any summary.

In practice, enforcement has targeted unlicensed providers and resellers, including Chinese citizens prosecuted for selling “ladder” services. Public reporting contains no pattern of foreign tourists being penalized for personal VPN use, and millions of visitors and residents use VPNs daily. But the formal rule is that cross-border access should go through licensed channels, so treat personal use as tolerated rather than expressly permitted. This is a travel practicality summary, not legal advice. If your company needs a compliant cross-border line, the legal route is leasing one from China Telecom, China Unicom, or China Mobile.

Why this keeps working, and why it won’t last

The firewall’s power has a ceiling: collateral cost. Blocking TLS to Microsoft would damage China’s own trade in software and cloud services. Blocking all random-looking UDP on port 443 would break a large slice of modern video and gaming traffic. REALITY and Hysteria2 both work by hiding inside traffic that has that protection.

Nobody should expect a permanent win. The March 2025 arXiv survey of obfuscation strategies makes the same point the 2023 and 2025 USENIX papers make: the censor studies every circumvention technique that gets popular, then adapts. VMess, REALITY’s older sibling in the Xray family, went from standard to burned as the firewall’s fingerprinting improved. The protocols above are the current front line, not the final answer.

Practical setup for the technically inclined: a VPS in Hong Kong, Singapore, or Japan, Xray with REALITY on TCP/443 as the primary, Hysteria2 with Salamander obfs on UDP/443 as the backup, and a fresh snapshot of the server image so a rebuild takes minutes. For everyone else: install two commercial VPN apps before departure, because failover matters more than speed, and then go enjoy the trip.

FAQ