Tunnelz

China trip guide

Should you run your own VPN server for China?

It can be worth it, if you accept the trade-offs. Only you use your own server, so nobody else’s traffic shares its address. It can still be blocked, it has a cost and upkeep, and it doesn’t make you anonymous. You can build one by hand, or let an app such as Tunnelz build it in your own Vultr account.

Updated

  • A shared VPN

    The VPN company runs the server, and other customers use it too.

  • Your own server

    You rent it from a hosting company, in your own account, and only you connect to it.

Fig. 01
The difference is who’s on the server. Simplified. Either one can be blocked, and no route is promised to stay open.

What “your own server” means

You rent a small server outside mainland China from a hosting company such as Vultr, and only you connect to it. The host still runs the machine, so you’re still trusting someone.

Shared VPN or your own server

Shared VPNYour own, by handYour own, with Tunnelz
Who’s on the serverYou and other customersOnly youOnly you
Whose accountThe VPN company’sYours, at a host you pickYours, at Vultr
What you payA subscriptionThe host: about $5 a month at VultrA Tunnelz plan, plus about $5 a month to Vultr
Setting upInstall an appYour own time, and server skillsAbout 10 minutes, most of it opening a Vultr account
UpkeepThe company’s jobYours: updates, firewall rules, loginsThe app checks the connection and reconnects. The server and its bill stay yours
If it’s blockedDepends on the companyBuild another and set up each device againReplace Server: a new address in about 2 minutes, if the app can reach Vultr
Can it be blocked?YesYesYes
Does it make you anonymous?NoNoNo
Fig. 02
Three ways to get a VPN for China, side by side.

A shared VPN suits you if you want someone else running the servers and nothing to look after. Your own server suits you if you’d rather not share an address with strangers, and you’re happy to pay for a server.

Only have a phone? A roaming eSIM usually covers your phone’s mobile data. VPN or eSIM gives a verdict by situation.

Your own server can be blocked too

Having a server to yourself doesn’t hide what your connection looks like. In a 2020 study, the firewall sent its own test connections to servers it suspected of being proxies. Only three of the researchers’ servers were blocked, by port or by address.

A 2023 study described blocking of traffic that looks fully encrypted. The firewall checked about a quarter of connections, on address ranges at popular hosting companies. It lists Vultr’s network, under its registered name Constant Co., among those heavily affected, though each block it measured lasted 3 minutes at most. Each study is from a point in time.

So build and test it at home, because Vultr is hard to reach in China without a VPN. A test at home can’t show what a Chinese network will do, so keep a backup way online, such as a roaming eSIM on your phone.

It doesn’t make you anonymous

A VPN hides your browsing from your internet provider, not who you are. As the EFF puts it, “A VPN is not a tool for anonymity”: sites can still track you through cookies, tracking pixels and fingerprinting.

Your own server is no better, and in one way worse: a shared server can put you in a crowd on one address, and yours has only you on it.

Your host knows who you are too: the server is in your own Vultr account, and Vultr bills you for it.

Your traffic doesn’t pass through Tunnelz, and we keep no record of the sites you visit. We do keep your email, your devices, your plan and the Vultr ID of the server we built. Our privacy policy lists the rest.

Building it by hand

There’s no recipe here on purpose: what gets through changes.

  • Rent a server from a hosting company, outside mainland China. Vultr bills by the hour until you destroy the server, and a stopped server is still billed.

  • Install VPN software, chosen with China in mind. Researchers have seen the firewall pick out some kinds of encrypted traffic, so what suits a VPN at home may not suit China, and what gets through can change.

  • Secure it, and keep it secure. Vultr’s security guide covers keeping the system updated, firewall rules and login keys.

  • Set up each device, and start again if it’s blocked. Every laptop and phone needs an app and the server’s details. If the address is blocked, you build a new server, update each device and destroy the old server.

Fig. 03
What doing it by hand involves, at a high level.

You pay only the host: about $5 a month at Vultr, plus $0.01 per GB for bandwidth over your plan’s quota. What it costs you is time. Our founder’s first server took an evening of firewalls and DNS fixes.

It suits you if you already look after servers.

Letting Tunnelz build it

Tunnelz builds a VPN server in your own Vultr account and connects your devices to it, with no server skills needed. The iPhone and iPad app is coming to the App Store.

  1. 1. Pick a plan. Download for Mac. Monthly and Yearly start with 3 days free, and the Trip Pass is one payment for 10 days.

  2. 2. Build in one click. The app helps you open a Vultr account, then builds your server in the fastest of its regions: Tokyo, Osaka, Seoul or Singapore.

  3. 3. Flip the switch. That’s it. Tunnelz picks the faster of its two protocols and reconnects by itself.

Fig. 04
Your own server with Tunnelz: about 10 minutes the first time, most of it opening your Vultr account. It needs a Mac with Apple silicon and macOS 14 or later.

For one trip, a Trip Pass and the server come to about $32 before tax.

Tunnelz doesn’t stop your server being blocked, and its terms say it can’t promise to work on every network, every day. If the address is blocked, you replace the server from the app. It has to reach Vultr, so keep that backup way online in case it can’t:

  • Your server stops answering

    Tunnelz shows “Reconnecting…”, and the server isn’t answering.

  • Click the gear, then Server, then Replace Server

    In about 2 minutes you have a new server with a new address, and the old one is deleted.

Fig. 05
Replacing a blocked server on your Mac. Simplified. A new address can be blocked too, and no route is promised to stay open.

Who deletes the server

A server costs money until it’s gone: Vultr still bills a stopped server, and billing ends only when it’s destroyed. By hand, remembering that is up to you.

When your Tunnelz plan ends, Tunnelz deletes the server it built 24 hours later, after a reminder, so Vultr stops billing too. Buy another pass or a plan within those 24 hours and it stays. You can also delete it from the app at any time.

Tunnelz doesn’t delete servers you made yourself or imported. If it can’t delete one, Vultr keeps billing until you do.

Questions

Can my own VPN server be blocked in China?
Yes. Researchers have seen servers blocked by port or by address. Test it at home, keep a backup way online, and expect that you may need a new address.
Does my own VPN server make me anonymous?
No. Sites can still track you through cookies and similar tools, your host knows who rents the server, and nobody else uses its address.
Is my own VPN server cheaper than a VPN subscription?
It depends. By hand you pay the host, about $5 a month at Vultr, plus your own time. Subscription prices vary. With Tunnelz you pay for a plan as well as the server.
Can I set up my own server once I’m in China?
Don’t plan on it. Vultr and the Tunnelz checkout are hard to reach in China without a VPN, so build your server and check that it connects before you fly.
Is it legal to use a VPN in China?
China has rules on this. They say VPN services need a government licence. Separately, China’s Cybersecurity Law was amended, and the changes have been in force since 1 January 2026. We’re not lawyers and this isn’t legal advice, so check current official guidance, such as your own government’s travel advice, before you go.

Sources