Great Firewall of China: VPN to China

What is the Great Firewall of China

The Great Firewall of China is the state censorship and filtering system that the Chinese government uses to control access to foreign internet services and regulate cross-border data traffic.

The “Great Firewall of China” (GFC/GFW) is operated by the Chinese Ministry of Information Technology (MIIT) and therefore comes directly from the Chinese government. It specifies which websites and so-called “keywords” must be blocked or filtered, and only a VPN to China has allowed data traffic to date. The firewall not only prevents access to services such as YouTube, Twitter, Facebook, Google and many other platforms from abroad in China, but also makes it difficult for companies to communicate with their branches there.

How companies used to bypass the Great Firewall

In the past, there have always been ways and means of circumventing the whole thing with the help of a VPN to China. Various VPN software was installed on a local computer and a remote server and established an encrypted tunnel (IPSec) between them. The data from the local computer in China was sent through the encrypted VPN tunnel to the server located abroad. This server then established the connection to YouTube & Co. and sent the data back in encrypted form. The GFC was unable to recognize the encrypted data as “forbidden” and did not block it accordingly. Companies have used the same method for their communication.

Regulation since 2017 and the situation today

With a regulation of 22 January 2017, the Chinese government declared war on precisely this VPN tunnel loophole. The aim was to shut down all VPN connections that made access to the free internet possible. The implementation deadline, originally set for the end of March 2018, was extended at the time to the end of March 2019.

Since then, the control has not loosened but become the norm: the GFC filters out IP addresses that stand out and blocks them permanently. Sometimes a single Google search by any employee for Facebook, Instagram and the like is enough, and a valuable IP address from your own pool is blocked and unusable forever. You can literally watch as IP addresses are caught one after another, until there is no way left to establish a connection at all. Companies with one or more branches in China that still communicate via encrypted VPN tunnels (IPSec) are therefore under pressure to act to this day.

Why companies bypass the Great Firewall

Companies use VPNs to dial into their intranet from their local servers (China Inland) or to protect their communication from third parties. Sensitive data such as

• Payroll accounting
• Building plans
• Strategy discussions
• etc.

can be transmitted without being read.

What solution exists today for companies

Before concrete measures to reduce downtime are implemented, a preliminary analysis should first determine which company data is particularly important in terms of availability and quality. Appropriate solutions should only be developed on the basis of this preliminary analysis and a calculation of the existing risk of failure. There are basically two solutions that represent real alternatives to a VPN to China. One of these is MPLS VPN. However, MPLS connections to China are very cost-intensive, and a small dedicated MPLS bandwidth can easily cost a five-figure sum per month. A more cost-effective alternative to MPLS VPN is SD-WAN China. The solution can be set up on the basis of local internet lines or internet lines already on site. Encryption takes place within the SD-WAN, and a further, separate encryption can also be used, without the key having to be deposited with a Chinese authority. SD-WAN is not just a stand-alone solution either, it can also be used flexibly to expand existing MPLS networks, for example via SAVECALL Dedicated China Connect.