VPN for China: what gets past the Great Firewall

• Addresses and names. Server addresses are blocked, DNS answers are poisoned, and TLS and QUIC connections are blocked by the site name they announce.
• Active probing. When a connection looks like a proxy, the firewall connects to the server itself to see how it answers. Servers that answer like a proxy get blocked.
• Traffic that looks like nothing. Connections made of random-looking bytes, with no recognisable protocol, can be blocked on sight. That is why many older encrypted proxies stopped working.
• Tightening periods. Blocking gets stricter around sensitive dates and events, then eases.

• VLESS Reality uses a real TLS 1.3 handshake under a real website’s name. A probe that connects without the right key is passed through to that website, so the server answers like the site it borrows.
• XHTTP keeps the same camouflage but splits traffic into many ordinary-looking web requests, for networks that flag one long connection.
• Hysteria2 is obfuscated QUIC over UDP. It can be fast, but UDP is often degraded, so treat it as optional.
• olcRTC rides a video call on a major video-conferencing service. It helps only if that service is reachable from your network, so test it rather than rely on it.

Reality borrows a website’s name, and each exit borrows its own. If that site is blocked or slowed in China, Reality to that exit fails with it, while an exit that borrows another site may work fine. The same goes for addresses: the firewall blocks servers one by one.

So if an exit fails from the start, try another before changing anything else. Exits closer to you usually mean lower latency; the marketplace lists every exit country with its price and uptime.

Routes from China are direct unless an entry node inside China is listed in the marketplace.

1. VLESS Reality on a direct route, to an exit near you.
2. Another exit, if that one fails from the start: a different address and usually a different borrowed site name.
3. XHTTP, if connections work at first but get cut after a while.
4. Hysteria2, only if UDP gets through on your network.
5. olcRTC, as an extra option to test while the video service it uses is reachable.

1. Create an account with an email address, or open the ProofKit bot in Telegram. A TON wallet is only needed to add funds.
2. Top up with TON from your wallet with TonConnect, or send a transfer to the escrow contract with the comment deposit from the wallet linked to your account.
3. Connect to an exit in the marketplace. Every connection becomes a server line in your app, and a line costs nothing until traffic flows through it.
4. Add your subscription link to your app once; it keeps the list up to date. In the dashboard, set Transports in subscription to All: the list for Happ, Hiddify and V2RayNG starts with Reality only. App guides: Hiddify, V2RayNG, help center.

• An exit gets blocked during a tightening period. Keep lines to two or three exits in your app so switching takes seconds.
• UDP is degraded. Hysteria2 slows down or fails; stay on Reality or XHTTP.
• Your balance reaches zero. Sessions close automatically; top up and your lines work again.

Rules on VPN use differ by country and change often. Check what applies where you are.