China blocks VPN: alternatives for companies

China strictly regulates cross-border Internet traffic and is increasingly blocking VPN tunnels that companies previously used from China to access foreign servers. Mainly affected are IPSec connections over the public Internet, which are considered an uncontrolled channel bypassing the Great Firewall. International companies with sites in China lose the accustomed secure access to central systems at headquarters as a result. The shutdowns often happen without prior notice and affect entire lines. Companies that do not prepare risk sudden outages of business-critical connections.

IPSec connections abroad are subject to strict and changing regulation in China and can be shut down at any time without notice. Companies can officially register their connections with the Chinese authorities and store keys, which reduces the likelihood of a shutdown but offers no guarantee. Purely domestic Chinese IPSec connections are not affected by the regulation. For business-critical site connectivity, an alternative such as MPLS or an SD-WAN overlay that does not run on the open Internet is therefore recommended. SAVECALL checks which solution fits your existing infrastructure.

Carrier MPLS connections are not affected by the IPSec shutdowns, as they are subject to different regulation and run over the private carrier network instead of the public Internet. This makes MPLS a reliable, if comparatively expensive, option for connecting to China. Many companies find pure MPLS lines to China too costly for their needs. For this reason, carriers such as China Telecom have developed cheaper SD-WAN alternatives that build on existing Internet lines but are routed compliantly via a licensed backbone.

SAVECALL Dedicated China Connect is an SD-WAN solution that builds on existing Internet lines as the underlay and routes traffic via China Telecom’s global cloud backbone. This legally bypasses the Great Firewall without requiring an expensive dedicated MPLS line. Sites receive SD-WAN hardware that connects to the nearest China Telecom cloud gateway. The result is a stable, compliant connection between European and Chinese sites with good performance. SAVECALL implements the solution in partnership with China Telecom.

An SD-WAN China solution such as SAVECALL Dedicated China Connect can typically be provisioned much faster than a classic MPLS line to China, which often requires several months of lead time. Since SD-WAN builds on existing Internet lines, there is no civil engineering or waiting time for a new carrier connection. The exact duration depends on the number of sites and the existing infrastructure on site. SAVECALL plans the migration so that the existing connection stays active until the switch has been completed successfully.

That depends on budget, number of sites, and requirements for bandwidth and control. A classic MPLS connection to China is reliable and compliant but expensive and comes with a long provisioning time. An SD-WAN China solution such as Dedicated China Connect is cheaper, ready faster and equally legal, but offers a different performance profile than a dedicated line depending on the application. SAVECALL compares both options vendor-neutrally and recommends the solution that fits your existing infrastructure and budget.