VPNs and the Great Firewall of China

How the Great Firewall blocks VPNs

• IP and keyword blocking — known VPN server addresses and DNS entries are dropped or poisoned.
• Protocol fingerprinting — the opening bytes of WireGuard, OpenVPN and IPSec connections are recognised and cut. This is the deep-packet-inspection layer described in how ISPs block VPNs.
• Active probing — when the firewall sees traffic it suspects is a proxy, it connects to that server itself and tests how it responds. If the server does not behave exactly like a normal web service, it is blocked. Few other countries do this at scale.
• Timing and volume analysis — long, steady encrypted flows to a single endpoint stand out from normal browsing.

Why the Reality transport exists

The Reality transport (used with VLESS on the Xray core) was designed specifically against active probing. It makes a server borrow the TLS identity of a real, unblocked website, so a probe sees an authentic handshake, and any visitor without the right key is passed straight through to that real site. There is no separate domain or certificate to leak. The full explanation is on what is the Reality transport.

This is why Reality-based tools are discussed in the context of China at all. It raises the bar for detection. It does not remove IP blocking, throttling, or the firewall's ability to adapt.

Why no VPN can promise China access

Whether any given service connects in China changes week to week, sometimes day to day, and varies by city, network and time. A transport that works in the morning can be caught by an updated rule in the afternoon. Any site that tells you a particular VPN "always works in China" is overselling. The honest position is: some transports have a better chance than others, and the only way to know about yours is to test it on the connection you will actually use.

If you want to try AVEE

AVEE uses VLESS + Reality by default, in its apps and in the subscription link for any VLESS client. It makes no claim to work in China. If you want to check, the honest way is to test it on your own connection: the $1 plan is the cheapest check (the one-time ~1 GB trial exists only for accounts created in the Android app). Plans start at $1/month. Also read how we measure availability, which explains why an availability signal is guidance, not a guarantee.

How to get started with AVEE

1. Open the web cabinet Create a 16-digit AVEE ID at aveevpn.com/account — no email needed.
2. Choose a plan and pay From $1 (100 GB), $2 (300 GB) or $3 (unlimited), using the payment methods shown at checkout.
3. Copy your subscription link Import it into Clash Verge, FlClash, v2rayN, Shadowrocket, Hiddify, Happ, Karing or any other VLESS/Reality client — on Windows, macOS, Linux, Android or iOS. The AVEE app for Android and Windows is optional.

The free trial exists only for accounts created in the AVEE Android app; accounts created in the web cabinet start as a paid plan.