{"id":16964,"date":"2018-08-02T15:47:02","date_gmt":"2018-08-02T13:47:02","guid":{"rendered":"https:\/\/www.savecall.de\/great-firewall-of-china-vpn-to-china\/"},"modified":"2026-07-21T08:55:10","modified_gmt":"2026-07-21T06:55:10","slug":"great-firewall-of-china-vpn-to-china","status":"publish","type":"post","link":"https:\/\/www.savecall.de\/en\/great-firewall-of-china-vpn-to-china\/","title":{"rendered":"“Great Firewall of China” – VPN to China"},"content":{"rendered":"\n

\n

\n

Great Firewall of China: VPN to China<\/h1>\n<\/div>\n\n\n\n

Trusted Advisor for IT & Telecommunications Sourcing<\/h3>\n<\/div>\n\n\n\n
\n
\n
Secure communication via the Great Firewall<\/h2>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
VPN alternatives for companies in China<\/h2>\n\n\n\n
The Great Firewall is increasingly blocking VPNs. SAVECALL shows compliant alternatives with MPLS and SD-WAN China.<\/h6>\n\n\n\n
The “Great Firewall of China” blocks numerous Western services and makes it difficult to exchange data between international locations. Traditional VPNs only work to a limited extent or are increasingly being blocked. Companies with offices or partners in China therefore need legally compliant and high-performance alternatives.<\/p>\n\n\n\n
<\/div>\n\n\n\n
In a nutshell:<\/strong><\/p>\n\n\n\n
\n
VPN restrictions:<\/strong> Chinese authorities block unauthorized VPN tunnels and IPsec connections<\/li>\n\n\n\n
High risks:<\/strong> Blocked IP addresses and interrupted communication can paralyze business processes<\/li>\n\n\n\n
MPLS as a secure solution:<\/strong> Stable but expensive connection with high availability and defined SLAs<\/li>\n\n\n\n
SD WAN as an alternative:<\/strong> Encrypted, flexible and cost-effective solution based on local Internet connections<\/li>\n\n\n\n
Legally compliant and high-performance:<\/strong> no key storage with authorities, modern encryption and global scalability<\/li>\n<\/ul>\n\n\n\n
<\/div>\n\n\n\n
The solution:<\/strong> SAVECALL helps companies to analyze, plan and implement modern network solutions to ensure stable connections to China: fast, legally compliant and powerful.<\/p>\n\n\n\n
What this article covers:<\/strong> This article explains what the Great Firewall of China is, how regulation has developed since 2017, and which alternatives such as MPLS and SD-WAN China are available today. The core question: How do you secure your corporate communications in and from China against blockages and outages?<\/p>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Table of contents<\/h3>\n\n\n\n
\n
What is the Great Firewall of China<\/a><\/li>\n\n\n\n
How companies used to bypass the Great Firewall<\/a><\/li>\n\n\n\n
Regulation since 2017 and the situation today<\/a><\/li>\n\n\n\n
Why companies bypass the Great Firewall<\/a><\/li>\n\n\n\n
What solution exists today for companies<\/a><\/li>\n\n\n\n
How SAVECALL supports<\/a><\/li>\n\n\n\n
FAQ<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n

\n
\n
\n
\n
\n
\n
\n
\n
\n<\/p>\n\n\n
\n
\n
What is the Great Firewall of China<\/h3>\n\n\n\n
The Great Firewall of China is the state censorship and filtering system that the Chinese government uses to control access to foreign internet services and regulate cross-border data traffic.<\/p>\n\n\n\n
The “Great Firewall of China”<\/strong> (GFC\/GFW) is operated by the Chinese Ministry of Information Technology (MIIT) and therefore comes directly from the Chinese government. It specifies which websites and so-called “keywords” must be blocked or filtered, and only a VPN to China has allowed data traffic to date. The firewall not only prevents access to services such as YouTube, Twitter, Facebook, Google and many other platforms from abroad in China, but also makes it difficult for companies to communicate with their branches there.<\/p>\n\n\n\n
How companies used to bypass the Great Firewall<\/h3>\n\n\n\n
In the past, there have always been ways and means of circumventing the whole thing with the help of a VPN to China<\/strong>. Various VPN software was installed on a local computer and a remote server and established an encrypted tunnel (IPSec) between them. The data from the local computer in China was sent through the encrypted VPN tunnel to the server located abroad. This server then established the connection to YouTube & Co. and sent the data back in encrypted form. The GFC was unable to recognize the encrypted data as “forbidden” and did not block it accordingly. Companies have used the same method for their communication.<\/p>\n\n\n\n
Regulation since 2017 and the situation today<\/h3>\n\n\n\n
With a regulation of 22 January 2017, the Chinese government declared war on precisely this VPN tunnel loophole. The aim was to shut down all VPN connections that made access to the free internet possible. The implementation deadline, originally set for the end of March 2018, was extended at the time to the end of March 2019.<\/p>\n\n\n\n
Since then, the control has not loosened but become the norm: the GFC filters out IP addresses that stand out and blocks them permanently. Sometimes a single Google search by any employee for Facebook, Instagram and the like is enough, and a valuable IP address from your own pool is blocked and unusable forever. You can literally watch as IP addresses are caught one after another, until there is no way left to establish a connection at all. Companies with one or more branches in China that still communicate via encrypted VPN tunnels (IPSec) are therefore under pressure to act to this day.<\/p>\n\n\n\n
Why companies bypass the Great Firewall<\/h3>\n\n\n\n
Companies use VPNs to dial into their intranet from their local servers (China Inland) or to protect their communication from third parties. Sensitive data such as<\/p>\n\n\n\n
\n
Payroll accounting<\/li>\n\n\n\n
Building plans<\/li>\n\n\n\n
Strategy discussions<\/li>\n\n\n\n
etc.<\/li>\n<\/ul>\n\n\n\n
can be transmitted without being read.<\/p>\n\n\n\n
What solution exists today for companies<\/h3>\n\n\n\n
$\"Technical$ <\/figure>\n\n\n\n
Before concrete measures to reduce downtime are implemented, a preliminary analysis should first determine which company data is particularly important in terms of availability and quality. Appropriate solutions should only be developed on the basis of this preliminary analysis and a calculation of the existing risk of failure. There are basically two solutions that represent real alternatives to a VPN to China. One of these is MPLS VPN<\/a><\/strong>. However, MPLS connections to China are very cost-intensive, and a small dedicated MPLS bandwidth can easily cost a five-figure sum per month. A more cost-effective alternative to MPLS VPN is SD-WAN China. The solution can be set up on the basis of local internet lines or internet lines already on site. Encryption takes place within the SD-WAN, and a further, separate encryption can also be used, without<\/strong> the key having to be deposited with a Chinese authority. SD-WAN is not just a stand-alone solution either, it can also be used flexibly to expand existing MPLS networks, for example via SAVECALL Dedicated China Connect.<\/p>\n<\/div>\n<\/div>\n\n\n

\n<\/p>\n

\n
\n<\/p>\n\n\n
\n
\n
\n
How SAVECALL supports your VPN modernization<\/h3>\n\n\n\n
<\/div>\n\n\n\n
The experts at SAVECALL will be happy to advise you on modernizing your VPN to China or worldwide. We help you from analysis to implementation of your MPLS VPN or your SD-WAN solution, vendor-neutral and with direct access to China Telecom as a partner.<\/p>\n\n\n\n
<\/div>\n\n\n\n
Conclusion on the Great Firewall of China<\/strong><\/h3>\n\n\n\n<\/div>\n\n\n\n
A classic VPN to China is no longer a reliable basis for business-critical communication today. MPLS remains stable and compliant but cost-intensive. SD-WAN China is the more affordable and flexible alternative, without the encryption key having to be deposited with a Chinese authority. Which solution fits depends on budget, number of sites and requirements for bandwidth and control.<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
\n
\n
\n
\n
$\"Frank$ <\/figure>\n<\/div>\n\n\n\n
\n
Written by<\/p>\n\n\n\n
Frank Frommknecht<\/h3>\n\n\n\n
Key Account Consultant, SAVECALL<\/strong><\/p>\n\n\n\n
Has supported companies for over 20 years in selecting and optimizing their connectivity solutions. His focus: making complex telecommunications understandable from the customer’s perspective and strategically finding the right solution.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n
<\/p>\n\n\n
\n
\n
Sources<\/h3>\n\n\n\n
\n
SAVECALL, “MPLS and IPSEC in China”, savecall.de\/en\/mpls-and-ipsec-in-china<\/a><\/li>\n\n\n\n
SAVECALL, “Enterprise WAN: SD-WAN, MPLS & Ethernet”, savecall.de\/en\/wan<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
Frequently asked questions about the Great Firewall of China<\/h3>\n\n\n\n
What is the Great Firewall of China?<\/strong>
The Great Firewall of China (GFC\/GFW) is a state censorship and filtering system operated by China’s Ministry of Industry and Information Technology. It blocks access to numerous Western services such as YouTube, Twitter or Facebook and filters content based on predefined keywords. For companies with sites in China, it additionally complicates internal communication with headquarters abroad. Classic VPN connections, which used to offer a detour around the block, are increasingly being detected and blocked. Anyone who wants to communicate reliably today needs a compliant alternative instead.<\/p> <\/div>
Does a classic VPN to China still work reliably today?<\/strong>
A classic IPSec VPN to China is considered unreliable and risky today. Since a regulation from 2017, China has continuously tightened control over encrypted tunnel connections and increasingly blocks them without prior notice. IP addresses that stand out or are used repeatedly get permanently blocked, sometimes triggered by a single access to a blocked platform. For business-critical communication, a classic VPN is therefore no longer a reliable foundation. Companies should rely on MPLS or SD-WAN China instead.<\/p> <\/div>
Why do companies use a VPN tunnel to China at all?<\/strong>
Companies with branches in China use VPN tunnels to securely dial into their intranet and protect their communication from third parties. The encrypted tunnel allows sensitive data such as payroll accounting, building plans or strategy discussions to be transmitted without being read. At the same time, the tunnel enables access to systems hosted abroad that would otherwise be unreachable from China. As classic VPNs are increasingly blocked, this need is shifting today toward MPLS and SD-WAN solutions.<\/p> <\/div>
What is the difference between MPLS VPN and SD-WAN for China?<\/strong>
An MPLS VPN to China is stable and compliant but cost-intensive. Even a small dedicated MPLS bandwidth can easily cost a five-figure sum per month. SD-WAN is the more affordable alternative and builds on existing local Internet lines. Encryption takes place within the SD-WAN and can be supplemented with an additional, separate encryption without the key having to be deposited with a Chinese authority. SD-WAN can also be flexibly combined with existing MPLS networks.<\/p> <\/div>
Do I have to deposit my encryption key with Chinese authorities?<\/strong>
With an SD-WAN solution for China, no key deposit with a Chinese authority is necessary. Encryption takes place within the SD-WAN and can be supplemented with an additional, separate encryption. This distinguishes SD-WAN from classic IPSec VPN approaches, where official registration with key deposit is possible but not always desired. For companies with high data protection requirements, this is an important decision criterion. SAVECALL advises you on this vendor-neutrally.<\/p> <\/div>
How do you start switching from VPN to a modern China connection?<\/strong>
Before taking concrete measures, a preliminary analysis should clarify which company data is particularly critical in terms of availability and quality. Based on this analysis and an assessment of the failure risk, you can decide whether an MPLS VPN or an SD-WAN solution fits better. SAVECALL accompanies companies from analysis through planning to implementation of the right solution. The existing connection stays active until the new one runs successfully, so no communication outage occurs during the switch.<\/p> <\/div> <\/div>\n\n\n
<\/p>\n\n\n
\n
\n
You might also be interested in<\/h2>\n<\/div>\n\n\n\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL at the 2026 Colt Charity Bike Ride<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Globale Internet-Beschaffung: Warum Inhouse-Sourcing oft teurer wird als gedacht<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-security-service-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-costs-site-connectivity<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-monitoring-visibility-operation<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-sla-mttr-what-counts<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
cloud-phone-system-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Mobile radio management<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Mobile Provider Comparison 2026<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Internet Connection Which Provider Fits<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Consulting<\/p>\r\n <\/div>\r\n\r\n
\r\n
why-vendor-sprawl-destroys-agility<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
AI-Enabled Networks: Why Bandwidth Alone Isn’t Enough\u2014and What CIOs Really Need to Focus On<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Global Connectivity from a Single Source<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
nis2-telecom-infrastructure<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"WAN$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-sd-wan-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
sase-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
Why cloud security is important<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Savecall$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
Second acquisition in twelve months: Savecall takes over landline customers from Bluestring<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
What and where are the challenges for the network infrastructure of most companies?<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL Holding GmbH founded: Clear structure. Strong foundation. Long-term partnership.<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
Mastering Shadow AI with SASE: Security and transparency for Gen-AI in the company<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n <\/div>\r\n\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n\r\n