China eSIM and the Firewall Question Most Guides Skip

The Firewall Truth No One Says Out Loud

A China eSIM gives you data. It does not give you Google, WhatsApp, Instagram or Gmail. The Great Firewall sits between your phone and those services whether you buy a travel eSIM or a local SIM from a Chinese carrier. The only difference is where your traffic exits. A travel eSIM routes via a gateway in Hong Kong or Singapore, so censored sites work without a VPN. A local SIM routes via a mainland gateway, so everything stays censored until you install a VPN before you land. Most guides skip this because they want you to buy something. Here is what actually happens.

Your phone gets a signal on a mainland network. China Mobile, China Unicom and China Telecom all carry roaming traffic for foreign eSIMs. That signal lets you call a Didi, open WeChat and scan an Alipay QR code at the noodle shop. But open the Google Play Store and you get a blank page. Tap WhatsApp and the message spins. Try Instagram and the feed stays grey. That is the firewall, not a signal problem. A travel eSIM bypasses it because your data exits via a Hong Kong gateway before it hits the mainland. A local SIM does not. You need the right combination of SIM type and VPN, and you need the VPN installed before you leave your home country because the China App Store removed every VPN app years ago.

What a Travel ESIM Actually Does for You

How Activation Works

A travel eSIM from one of the two dozen providers listed in this guide works like this: you buy a plan for 3 to 30 days, scan a QR code before you fly, and activate it when you land. Your data connects to China Unicom, China Mobile or China Telecom on the ground, but your traffic leaves via the provider's home network in Hong Kong, Singapore, Japan or the US. That exit point is outside the firewall. Google Maps loads. WhatsApp messages send. Instagram refreshes. Gmail syncs.

Cost, Speed, and Phone Requirements

The downside is cost and speed. Travel eSIMs run USD 5 to 50 for 1 to 20 GB. That is roughly 35 to 360 RMB for the same data a local SIM would give you for 50 to 300 RMB. Speed is 4G LTE on most plans; 5G is available on some but not guaranteed. Unlimited plans throttle after a cap, and hotspot tethering is restricted on some of those unlimited plans. You also need a phone with an eSIM slot and no carrier lock. iPhone XS or later works. Most Android flagships from the last three years work. If your phone is carrier locked or three years old, you need a physical SIM instead.

Choosing a Provider

Do not assume all travel eSIMs work equally. The provider's network partner inside China matters. The most common partner is China Unicom, but some plans use China Mobile or China Telecom. If you buy a plan from a Hong Kong provider like 3 Hong Kong, China Unicom HK or China Mobile Hong Kong, you get the same gateway exit but better customer support for troubleshooting. A travel eSIM bought before you fly costs less than roaming and is set up in minutes, with the tradeoff that support is email rather than a shop you can walk into. Decide based on whether you want to save money or have someone answer a WeChat message at 11pm in a Beijing hotel lobby.

Local SIMs: Cheaper Data, Same Firewall Problem

Registration and Activation

A local SIM from China Mobile, China Unicom or China Telecom costs CNY 50 to 300 for 7 to 30 days with 5 to 30 GB. That is cheaper per gigabyte than any travel eSIM. You get 5G speed on all three carriers, full hotspot tethering, and top-up options at convenience stores or via WeChat and Alipay.

The tradeoff is registration. You need your passport and a facial recognition scan at an official carrier store or an airport counter. Hotel staff cannot do it for you. No anonymous SIMs exist. One passport can register multiple SIMs across carriers, but you have to visit each store. The SIM must be activated before you leave the store. If your phone does not have a physical SIM slot, the eSIM option is available at select stores for China Mobile, China Unicom and China Telecom, but not every store offers it. You also need an unlocked phone. A carrier locked phone will not work on a Chinese network.

What Stays Censored

And you still need a VPN. A local SIM routes your traffic via a mainland gateway. That means every censored service stays censored. Google, WhatsApp, Instagram, Gmail, Facebook, X, Telegram, TikTok (international version), Snapchat, Reddit, Discord, Netflix, Zoom, Skype, Wikipedia, BBC News, New York Times, Reuters, Bloomberg, The Guardian, Dropbox, Google Drive, Signal, Line, KakaoTalk. All unavailable. You cannot even browse the Chinese version of Wikipedia because it redirects to the censored global version. The only Google service that works is none. The only search engine that works is Bing at bing.com. Apple Maps works in its China mainland version. Baidu Maps and Amap work. Microsoft Office 365 and OneDrive work intermittently. Outlook.com works intermittently. Everything else requires a VPN.

Hotel Wi-Fi Won't Help

Hotel Wi-Fi does not solve this. Every hotel in China runs behind the firewall. Some international business hotels have a separate SSID for foreign guests that routes via a Hong Kong or Macau gateway, but that is rare and unreliable. Assume hotel Wi-Fi is firewalled. Book a SIM for your phone, not the room.

Which VPN Works and How to Prepare

How the Firewall Blocks VPNs

Personal VPN use in China is a legal gray area. Enforcement against individual tourists is rare, but the firewall actively blocks VPN traffic at the protocol level. The Great Firewall uses DNS poisoning, IP blocking, SNI filtering, deep packet inspection, active probing of VPN servers, and protocol obfuscation detection. It blocks OpenVPN, WireGuard, IPsec, L2TP, PPTP, SSTP, IKEv2, Shadowsocks, V2Ray, Trojan, Hysteria, TUIC, naivproxy and reality protocols. It blocks cloud provider IP ranges from AWS, GCP, Azure, DigitalOcean, Linode and Vultr. It blocks Tor bridges and pluggable transports. It blocks DNS over HTTPS, DNS over TLS, DNSCrypt and Oblivious DoH. It blocks QUIC to force TCP fallback. It fingerprints TLS 1.3 and TLS 1.2 connections.

Install Before You Fly

A VPN that works in China uses an obfuscated protocol and a residential IP address, not a datacenter IP. That means you cannot just download the top three apps from the App Store. You need one that specifically markets itself as China capable, and you need to download it before you leave. The China App Store does not list any VPN apps. If you arrive without one, you will spend your first afternoon searching Chinese forums in Chinese with no translation tool because Google Translate is also blocked.

Backup Plan

Install two VPN apps. Not one. The firewall sometimes blocks a specific VPN during political events, holidays or leadership meetings. Having a backup means you switch, not panic. Test both in your home country before you go. Then leave them installed. Do not delete and reinstall. The firewall blocks VPN traffic based on protocol signatures and server IPs. If your VPN stops working, switch to the backup. If that also stops working, use a Shadowsocks or V2Ray server on a non cloud provider IP. If you do not know what that means, buy a travel eSIM that exits via Hong Kong and skip the VPN entirely. That is the simplest path for most tourists.

The One Scenario Where You Should Buy a Local SIM

A local SIM makes sense if you stay more than 14 days, need more than 20 GB, or plan to use hotspot tethering for a laptop. A travel eSIM with 20 GB for 30 days costs around USD 40 to 50. A local SIM with 30 GB for 30 days costs around CNY 200 to 300, or roughly USD 28 to 42. The local SIM is cheaper per gigabyte and lets you tether without worrying about throttling.

But you still need a VPN. Budget for that cost and the time to install it before you fly. If you arrive at Beijing Capital Airport at 10pm after a 12 hour flight, the last thing you want to do is find a China Mobile counter, queue for a facial recognition scan and explain in broken Chinese that you want a data plan. Book a travel eSIM from a provider like 3 Hong Kong or China Unicom HK before you leave. Activate it on the airport train. You will have Google Maps working by the time you reach Dongzhimen station.

One more thing. Do not buy a local SIM at the airport unless you are arriving at a major international terminal where the carrier counters are staffed. Some smaller airports only have vending machines that do not accept foreign passports. And never let a hotel staff member try to register a SIM for you. It is illegal. They cannot do it. The passport and facial recognition must be yours at a carrier store.