Do free VPNs work in China? I tested eight of them
Proton, Windscribe, hide.me, TunnelBear, WARP and three app-store specials, tried from a residential line in mainland China. Zero connected. Here is why, and what people there actually use.
The follow-up to Free VPNs that still work in 2026, because this question comes in more than any other.
The conclusion first: international free VPN brands do not work from inside mainland China. Not because they are bad products. Because the road is closed.
Eight apps, June 2026
Residential broadband, no pre-existing proxy, Windows 11 and an iPhone.
| Service | Site loads | Client downloads | Connects | Note |
|---|---|---|---|---|
| Proton VPN free | No | No | — | DNS poisoned |
| Windscribe free | No | No | — | Same |
| hide.me free | No | No | — | Same |
| TunnelBear | No | No | — | Same |
| Cloudflare WARP | Yes | Yes | Intermittent | See below |
| Urban VPN | Via store | Yes | No | Hangs at 90% |
| Turbo VPN | Via store | Yes | No | Same, plus heavy ads |
| One "turbo" app | Yes | Yes | No | Six notifications on install |
Eight tried, zero usable connections.
Three layers of why
Layer one: you cannot get the client
Proton, Windscribe, hide.me and TunnelBear's websites do not resolve. Which produces a neat trap: you need the tool to get out, and you need to get out to obtain the tool.
The Chinese App Store removed this category some time ago. Android side, you would need an APK mirror, and those are in much the same position.
Layer two: the server ranges are blocked
Suppose you obtained the client anyway. The server addresses are public — they have to be, the client needs to know where to connect. Public lists are the easiest thing in the world to block.
Layer three: the protocols are conspicuous
This is the fundamental one, and the least understood.
OpenVPN, IKEv2/IPsec and WireGuard were designed for security and speed, not for blending in. Their handshakes have fixed signatures:
- OpenVPN's opening packets carry recognisable opcodes
- WireGuard's handshake is a fixed length with a fixed first byte
- IKEv2 lives on UDP 500 and 4500, which is a flag by itself
Fingerprinting that is about as difficult as spotting a traffic light.
About Cloudflare WARP
WARP gets recommended for this constantly, and the recommendation is based on a misunderstanding.
WARP is designed to get your traffic into Cloudflare's network quickly and privately. It is not a circumvention tool. The free version does not give you a foreign exit; your IP stays regional.
In practice its UDP traffic sits under persistent interference. Sometimes it connects and performs adequately. Sometimes it connects and nothing loads. A connection you cannot predict is not a connection you can rely on.
What actually works there
Two paths, both using the same client software.
Path one: free nodes and subscriptions
Nodes running SS, VMess, Trojan or Hysteria2, imported into a Clash-family client.
- Where to find them: Free proxy nodes: where they come from
- Subscription sources: Public subscription links that still update
- Client setup: Clash Verge Rev setup
The cost: instability. Median lifespan across the 47 nodes I tracked was six days.
Path two: a paid provider
Identical protocols, identical clients. The difference is that somebody maintains it — dead nodes get replaced, blocked IPs get rotated.
The cost: money. Entry tiers run about ¥29 a month, roughly four dollars.
If you are travelling there
Practical checklist, because the timing matters:
- Install and configure everything before you go. Client, subscription, tested and working.
- Save the subscription URL somewhere offline — a note on your phone, not a bookmark on a site you will not be able to reach.
- Bring two. Different providers, different protocols. One will have a bad week.
- Keep a TCP-based node alongside a UDP-based one. Some networks restrict UDP outright, which kills Hysteria2 while Trojan keeps working.
- Turn on routing rules so domestic traffic goes direct — otherwise everything local becomes slow and you will assume the proxy is broken.
One thing worth repeating
Whichever path you take, do not sign into banking, work email or payment accounts over a node you cannot vouch for.
That sentence appears across this whole site because it is the one that matters most. The reasoning is in Is using free nodes safe?.
Read next
- Free VPNs that still work in 2026
- How free VPNs make money
- Free proxy nodes: where they come from
- Connected but nothing loads
Questions people keep asking
Why do international VPN brands fail in China specifically?
Three layers stack up. The provider websites are unreachable, so you cannot download the client. Their server ranges are published and blocked. And the protocols themselves — OpenVPN, IKEv2, WireGuard — have fixed, easily fingerprinted handshakes. Any one layer would be enough on its own.
So what do people there use instead?
A different stack entirely: protocols built to resist traffic fingerprinting (Shadowsocks, VMess, Trojan, Hysteria2) running in clients like Clash Verge Rev, sing-box or Shadowrocket, fed by a subscription link.
Should I install a VPN before I travel?
Yes, if you are going to want one. Install and configure everything before you arrive, because downloading it once you are there is the hard part. Also save an offline copy of any subscription link.
Is Cloudflare WARP an option?
Not as a primary. WARP encrypts traffic into Cloudflare's network; it is not built to cross a national filter, and the free version does not change your country. Its UDP signature draws attention, so it works intermittently, which is arguably worse than not at all.