FAQ

"梯子" ("ladder") is the general term for circumvention tools; "机场" specifically means a paid proxy-node subscription service, usually built on protocols like Shadowsocks, V2Ray, or Trojan; "VPN" is a broader encrypted-tunnel technology — different mechanism, similar goal. A proxy-subscription service is typically cheaper and faster, but you have to pick your own client (Clash, Shadowrocket) and import the subscription link yourself; a commercial VPN is usually "one app and you're done," but generally slower and less resistant to blocking.

There's no one-size-fits-all answer — it depends on your jurisdiction. In mainland China, using an unauthorized international connection channel without approval carries a risk of being found in violation of relevant regulations, and there have been media reports of administrative penalties for this. Whether and how you use these tools is your own call to evaluate against local law and your personal risk tolerance — this isn't legal advice; see the disclaimer page for the full statement.

Entry-level plans typically run ¥10–30/month; dedicated-line (IPLC/IEPL) services cost more, usually ¥40–100+/month. The difference mainly comes from line type — plain BGP transit is cheapest, dedicated lines cost more but have lower latency. Look at the plan's data cap, device limit, and line type first, not just the price.

Yes — the service itself doesn't care what device you use, both iOS and Android work. On iPhone, Shadowrocket (needs a non-China Apple ID to download) or Stash are common; on Android, Clash for Android or v2rayNG. After installing the client, import the subscription link your provider gave you and you're set — though not every provider hands you a link the moment you sign up anymore; some require contacting support for one, and others have moved to their own app instead (in that case you just connect inside the app, no separate client needed). The exact process is usually covered by the provider's support or a setup guide on their site.

The most common reason is that node's IP has been detected and blocked by the firewall — this happens especially often around specific dates (major events, anniversaries), and providers usually roll out replacement nodes in response. Other common causes: the official domain gets DNS-poisoned so the subscription link won't load, the server gets DDoSed, or a shared transit entry IP gets blocked, taking down every downstream node with it. If you're seeing widespread issues, check the provider's announcements or community channel first — it usually resolves within a few hours to a couple of days.

"跑路" (literally "running away") means a provider abruptly stops operating and disappears with customer funds — plans you paid for, especially prepaid annual or multi-year ones, become worthless and are hard to recover. Common causes: the business becomes unsustainable and loses money, regulatory or upstream-line pressure shuts it down, or in some cases the provider was a short-term cash grab from the start — a low-price promotion to collect a wave of prepayments before disappearing.

A few signals worth watching for: a sudden, deeply-discounted annual or multi-year promotion far below the normal price (e.g. a long-term rate of just a few dollars a year); support goes silent for an extended period, or their community channel gets locked to admin-only posting; a large number of nodes fail for multiple days straight with no official explanation; existing customers get ignored while the provider keeps aggressively marketing for new sign-ups. No single signal necessarily means trouble, but multiple signals at once are worth taking seriously.

A few practical habits: for a provider you don't know well, use a monthly plan for the first 1-2 months and observe stability before considering an annual commitment — don't prepay a large sum to an unknown provider up front; favor providers that have been operating longer (two-plus years) with a relatively stable reputation; keep 1-2 backup services rather than putting all your eggs in one basket; avoid sending sensitive information like banking or social-account passwords over the connection, and consider rotating providers or subscription links every 3-6 months.

First, cancel any auto-renewal/auto-billing tied to that provider so you don't keep getting charged. Be extremely wary of DMs or links claiming to offer "compensation" or a "refund" from that provider — these are frequently phishing scams designed to steal your payment details or squeeze one more charge out of you, so don't click unfamiliar links or hand over payment information in response. Treat this as a reminder to diversify going forward — consider running 1-2 services at once as primary and backup, rather than depending on a single provider.

Generally, be cautious. Free services have to monetize somehow — common approaches include collecting and selling user data, injecting ads, or simply using the free tier as a funnel toward a future paid upsell, and service quality and privacy protection are usually hard to verify. By comparison, a paid provider with transparent pricing, monthly billing, and a track record you can check is usually the safer, more sustainable choice.

These are all common proxy protocols used by this kind of service, and day-to-day experience doesn't differ that much between them: Shadowsocks is the simplest and needs no certificate; Trojan disguises itself as HTTPS traffic for better stealth; Hysteria2 runs on QUIC/HTTP3 and shows more of a speed advantage when the underlying line quality is mediocre. Unless you have a specific need, just use whatever protocol your provider gives you by default — it's not worth agonizing over.

The rate multiplier is the coefficient a provider uses to calculate data usage — higher isn't better. A node at 2.0x means using 1GB of actual data deducts 2GB from your plan; a node at 0.5x only deducts 0.5GB. For everyday browsing and news reading, favor low-multiplier nodes to save data; switch to a high-multiplier node (usually corresponding to an IPLC/IEPL dedicated line) when you need 4K streaming or dedicated-line-grade quality.

BGP transit is the cheapest, running through ordinary international exits that tend to get congested at peak hours; IEPL and IPLC are carrier-grade private dedicated lines — lower latency, more resistant to interference, and noticeably more expensive, with IPLC typically outranking IEPL on both quality and price. BGP transit is fine for everyday use; dedicated lines suit gaming, video calls, and other latency-sensitive scenarios better.

In the Clash client, find the "Profiles" (or "Configuration") section, paste the subscription link your provider gave you, and tap download/import — once it succeeds, the node list appears under your policy groups. If nothing shows up after importing, check that the subscription link is complete and that your plan hasn't expired.

First, paste the subscription link directly into a browser address bar: if you land on a login page, an expiration notice, or an error page instead of a wall of proxy parameters, the problem is with the subscription itself (e.g. an expired plan), not the client. If the link opens fine on its own, then check your client's network connection and DNS settings next.

Rule mode automatically decides for you: domestic sites connect directly, only sites that need a proxy get routed through a node — fast, and doesn't slow down access to local services. Global mode routes all traffic through the proxy, including domestic sites. Rule mode is the everyday recommendation; only switch to Global temporarily to troubleshoot a site that Rule mode isn't handling correctly.

Yes — on Windows, Clash Verge or Clash for Windows are common; on Mac, ClashX or Stash. Install the client, import the subscription link your provider gave you, and you're set — the process is similar to mobile. Whether you get that link right after signing up varies by provider these days — see our guide on why you might have to ask support for one.

Yes — routers that support flashing third-party firmware like OpenWrt or Merlin can have proxy rules configured directly on them, giving every device on the network (including TVs, consoles, and other devices where installing a client isn't practical) automatic circumvention. This does require some router and networking know-how, though — a higher setup bar than a phone or computer client.

Depends on the specific plan — most providers state a device limit in the plan details (e.g. 3, 5, or unlimited devices), and going over it can cause some devices to drop or the subscription to get throttled. Confirm the device limit before buying; an unlimited-device plan is usually better value.

Technically, usually yes, but be aware of your employer's or school's network monitoring and policies — some organizations log network traffic or explicitly prohibit proxy tools. Whether it's compliant is on you to check against your organization's rules and local law.

The usual cause is that your client only proxies browser traffic while DNS requests still go over your local network, so your IP location and DNS location don't match, which gets flagged as suspicious by the platform's risk controls. Try switching your client to Global mode so all traffic — including DNS — routes through the proxy node, then try registering again.

Streaming platforms maintain blocklists of known proxy IPs, and cheap, heavily-shared nodes get flagged more easily; a mismatch between your DNS location and node IP location also causes unlock failures. Before buying, check whether the provider explicitly labels certain nodes as "streaming-unlock" nodes — ordinary nodes aren't guaranteed to work.

You need an overseas node whose IP location matches your target region, and you'll usually also need to change your device/app-store region settings and use a payment method or account tied to that region to complete download and sign-up — a node alone doesn't always fully deliver a working "other region" experience. The exact steps change fairly often as platform policy shifts, so check the provider's or community's latest guide.

Throttling usually happens in two situations: your plan's data allowance runs out and the provider drops your speed to a crawl (e.g. 1Mbps) until the next billing cycle resets it, or unusual short-term usage triggers an anti-abuse mechanism and you get temporarily throttled. Most providers let you buy an extra data top-up for the current month.

First, refresh your subscription in the client, then use the latency-test feature to pick the node with the lowest number (usually shown in green). If everything is uniformly high, check whether you accidentally left Global mode on, which routes domestic traffic through the proxy too. If that's not it, try switching the proxy port — sometimes your local ISP throttles the default port specifically.

Yes, this is normal — roughly 8pm to 11pm is international-traffic peak hour, and even a stable service can slow down during this window. Try lowering video quality or switching to a less-popular node region; dedicated-line (IPLC/IEPL) services are generally affected less by peak-hour congestion than plain transit lines.

Payment itself runs through Alipay's or WeChat Pay's own official payment channel, with security guaranteed by the payment platform — no different from an ordinary online purchase. These services typically don't require identity verification, usually just an email sign-up. The one thing to watch: payment details should only ever go to the payment platform itself — be very suspicious if a provider's support asks you directly for your card number or verification code.

Technically, most providers don't restrict this, but sharing an account means sharing your device-count and data allowances, which can trigger throttling or drops more easily. Some providers' terms explicitly prohibit reselling or sharing accounts — check the specific terms of the plan you bought.

Depends on your technical level and needs: self-hosting on a VPS gives better privacy and a lower chance of being individually targeted for blocking, but requires some Linux and networking knowledge and ongoing maintenance on your part. A subscription service needs essentially no technical skill — the provider handles operations — but your reliability is entirely dependent on the provider's competence, and there's shutdown risk. Beginners generally do better starting with a subscription service.

This is a common chicken-and-egg problem for newcomers. Typical workarounds: connect briefly using a free trial node shared by a friend; some providers' own sites are hosted on domains/CDNs that aren't blocked and are directly reachable; or use a public directory/review site (like this one) to research your options before deciding which provider to buy from.

It's hard to guarantee they don't. Many providers claim "no logs," but for operational reasons — preventing account sharing, limiting concurrent connections, handling DNS requests — most providers do retain some level of connection log (e.g. connection times, data volume, and in some cases even the domains/SNI you visited). Weigh a provider's privacy policy and reputation when choosing, but don't assume any provider keeps absolutely zero records.

There's theoretically a possibility of being detected as generating "unusual international traffic," especially if you're using an old, unobfuscated protocol or a heavily-flagged node. Whether that leads to further scrutiny, and what the consequences might be, is covered in this page's answer on legality above — evaluate the risk for your own situation, since there's no technical guarantee of never being detected.

A DNS leak means domain-lookup requests aren't going through the proxy tunnel — they're going straight to your local ISP's DNS server instead. Even if your traffic itself is encrypted, your ISP can still see which domains you're visiting. You can check for this with a "DNS leak test" site while connected; if you find a leak, you'll typically need to manually set the proxy's DNS server in your client or enable its leak-protection option (most mainstream clients have one).

Entirely depends on that provider's own terms — there's no industry standard. Some allow no-questions-asked refunds within a short window (e.g. 24–48 hours, before heavy usage); plenty of others explicitly don't offer refunds at all. Check the specific refund policy before buying — this is also part of why starting with a monthly plan instead of committing to a year up front is the safer move.

First check whether their community channel, official account, or ticket system offers another way to reach them. If multiple channels stay unresponsive for an extended period, combined with node outages or the site itself being unreachable, that combination may be one of the shutdown warning signs covered above.

If you're just using it to connect and play normally, the ban risk is generally much lower than what you'd get from cheating, scripting, or account trading, and most platform terms don't explicitly ban proxy use outright. But using a cheap, heavily-shared node that gets flagged as abusive, or using it specifically to region-switch and exploit regional pricing or availability, carries noticeably higher risk.

Yes, but these services are designed mainly for circumvention rather than dedicated game acceleration, so results vary by line: an IPLC/IEPL dedicated line has lower latency and suits latency-sensitive games better, while plain BGP transit can show noticeable latency swings at peak hours. If gaming performance is your main need, prioritize a provider that explicitly states dedicated-line or low-latency node support.

Because with BT/P2P downloads, your node's IP gets directly exposed to every other peer in the swarm — copyright holders can easily trace that IP and file a complaint with the hosting provider, who will often just shut the server down on complaint, affecting every other user sharing that node. That's why almost every provider explicitly bans BT/P2P traffic in their terms, and some enforce it by blocking the relevant ports.

Not entirely, but "you get what you pay for" mostly holds in this market — extremely cheap providers tend to cut corners on bandwidth and line cost, and get congested when usage is high. Price matters more as a signal of whether the line type (BGP/IEPL/IPLC) actually matches what you need, rather than assuming pricier automatically means better.

No. In practice, you'll really only ever use a handful of main regions — Hong Kong, Japan, Singapore, the US — and node count on its own says nothing about line quality. A provider with 60 nodes isn't necessarily more stable than one with 20; what actually matters is how the main nodes perform at peak hours.

Stability and real-world experience usually matter more than a raw speed-test number — a provider that benchmarks fast but drops constantly during peak hours is worse to actually use than one with average benchmarks but consistent year-round reliability. When choosing, weigh a provider's reputation and long-term track record (see the "Most Stable" category) rather than a single speed test.

The GFW (Great Firewall) is the general term for mainland China's network censorship and blocking system, which uses layered techniques — DNS poisoning, IP blocking, deep packet inspection (DPI), TLS fingerprinting — to detect and interfere with traffic accessing blocked overseas sites or using circumvention tools. Much of the technical evolution of these services and circumvention tools has been driven by keeping up with the GFW's improving detection capabilities. gfw.report, an independent research group focused specifically on the GFW, publishes technical writeups that go into far more depth than we can here.

DPI (Deep Packet Inspection) is one of the core techniques the GFW uses to identify traffic type — it doesn't just look at the destination address, it also analyzes packet contents and characteristics (e.g. whether the traffic matches the handshake pattern of a known proxy protocol) to judge whether that traffic is circumvention tool usage. This is also why newer protocols like Trojan and Hysteria2 put heavy emphasis on "disguising as normal HTTPS/QUIC traffic" to defeat DPI detection — gfw.report's published research has a much more detailed technical breakdown of the actual detection rules.

CN2 GIA is China Telecom's highest-quality class of international line, with higher QoS priority — latency and packet loss from mainland China to international nodes is usually noticeably better than on an ordinary line. It's a form of dedicated/premium transit, costs more than plain BGP transit, and commonly shows up in pricier stable or premium-tier plans.

Users in mainland China accessing bing.com get automatically redirected to cn.bing.com (Bing's mainland version), and basic search works without a proxy; but the full international version — including certain AI chat features — is generally only available on the international site, which does need circumvention to reach. This is also part of why this site chose to focus its SEO on Bing specifically — it's one of the few overseas search engines that's at least partially reachable without a proxy.

No — Google's core services, including Search, Gmail, and Google Maps, are all unreachable in mainland China without circumvention tools. The Gmail mobile app tends to be somewhat more stable than the web version once you've solved the underlying access problem, but you still need that first.

A few signals to check: if the provider's site loads fine, support/community channels are responsive, and node outages get fixed promptly, renewing is generally fine. If you're instead seeing the site down, support going unanswered for a long stretch, no updates in their community channel, and widespread user reports of nodes being down all at once — don't renew blindly. Wait a few days and observe, or switch to a backup provider.

There's no standardized "migration" mechanism between providers — in practice, you sign up with the new provider and get a new subscription link (some give it to you right away, others only after you ask support, and some hand you their own app instead), add it as a new profile in your client (e.g. Clash) alongside the old one, confirm the new nodes connect properly, and only then delete or disable the old subscription. Both subscriptions can coexist for a while so you can compare them side by side.

If your goal was reaching content blocked in mainland China, you generally won't need it anymore once you're abroad, since most other countries don't have similar blocking. But if your need flips — you're abroad and want to access mainland content — that's the opposite direction (an "access China from overseas" service), which is a different use case from the outbound services this site reviews. Be clear on which direction you actually need before buying.

Technically yes, and some providers do support streaming-software use cases like OBS, but these services are primarily designed and tuned for everyday browsing and streaming consumption, not high-bitrate live uploads over long sessions, which demand more from a line's stability and upstream bandwidth — results vary a lot by provider quality. If live streaming is your core need, confirm with the provider beforehand whether they explicitly support or recommend it for that use case.

"翻墙" means using technical means to get around network censorship (the GFW, or "Great Firewall") to reach blocked overseas sites or services — "the wall" is a metaphor for that censorship system. It refers to the exact same thing as "科学上网" ("scientific internet access") — "翻墙" is just more blunt, while "科学上网" is the more euphemistic, neutral-sounding phrasing.

Yes, they're the same thing. "科学上网" originally became popular as a euphemism on search engines — it sounds more neutral and "legitimate" — but technically it's identical to "翻墙": both mean getting around network censorship to access overseas content. Which term someone uses is mostly a matter of context and habit, not a difference in method or risk.

Not exactly the same level of concept. "梯子" is a general metaphor for circumvention tools/nodes; "机场" is the specific type of provider that sells those "梯子" (nodes) — a 机场 is, in effect, selling you a ladder. Think of a proxy-subscription service as one common way to get a ladder, not as an exactly equivalent term.

No — VPN itself is a broader encrypted-tunnel technology, used for things like corporate remote work and securing data on public WiFi; circumvention is just one common use case among several. In the mainland China context, "VPN" is often used colloquially as shorthand for a circumvention tool, but technically VPN and "翻墙" aren't exactly the same concept.

The term traces back to early circumvention tools commonly using an airplane icon and the metaphor of "taking off" over the blocking, combined with the fact that a provider's node listing resembles a flight schedule. Over time, platforms offering proxy-node subscriptions came to be called "机场" ("airport") — it has nothing to do with actual airports.

Not quite. A "network accelerator" more often refers to a tool aimed at improving access speed (like a game accelerator), technically closer to CDN acceleration; a proxy-subscription service is built on protocols like Shadowsocks, V2Ray, or Trojan, specifically to get around network censorship. There's some technical overlap, but a proxy service's core goal is "can I access this at all," while an accelerator's core goal is "how fast can I access it."

No — the two terms just differ in phrasing, describing exactly the same behavior; the legal and technical risk doesn't change based on how euphemistically you phrase it. For the specifics on legal risk, see this page's answer on legality above.

Prioritize a few concrete signals: does the provider offer a refund guarantee or let you trial monthly (low cost to change your mind if it's not a fit); is support responsive; is the review content based on real, extended testing rather than just aggregated marketing copy. Be wary of any "recommendation" list that can't explain its own review methodology.

Roughly three categories: turnkey VPN clients with built-in nodes, self-hosted VPS setups you build yourself, and proxy-subscription services where you pick your own client and import a subscription link. Strictly speaking, a proxy-subscription service is a "node provider," not software itself — you still need to pair it with client software like Clash or Shadowrocket.

"VPN recommendations" usually point to closed, all-in-one products (download the app, tap connect); "proxy-service recommendations" point to node subscriptions where you choose your own client. If you want the simplest possible experience, start with VPN options; if speed, resistance to blocking, and client flexibility matter more to you, proxy services are worth the extra research — the two aren't mutually exclusive, and plenty of people use both depending on the situation.

Not exactly, but cheap services do tend to cut corners on bandwidth and line cost. The real question isn't the price itself, it's whether the line type behind that price actually matches what you need — a cheap service is plenty for occasional browsing, but if you need high stability and low latency, the price usually goes up accordingly.

Good value doesn't mean the lowest price — it means what you pay actually matches the line quality, stability, and device allowance you're getting. When comparing, look at line type, device limits, and reputation across a few similarly-priced providers, not just the monthly number on its own.

It's possible but not easy — some providers get a decent transit line down to a relatively affordable price through scale. In general, extremely low prices usually mean some trade-off on stability; if stability is a hard requirement, prioritize providers that have been running longer with a solid reputation rather than comparing on price alone.

Worth distinguishing between a first-hand review based on real, extended testing versus a page that's just aggregated from other sources — a purely aggregated list may not have even verified whether the provider is still operating. Check whether the list explains its review methodology and whether each listing has a "last verified" date — both are practical signals of how trustworthy it actually is.

Products positioned as "network accelerators" sit in a similar price range to proxy services — entry-level options run roughly the same ten-to-several-dozen dollars a month, with some gaming-focused accelerators pricier still. The label alone doesn't tell you what you're getting — confirm before buying whether the core function is "speed" or "access," since the underlying technical requirements aren't quite the same.

Start with the basic concepts (what a proxy-subscription service is, protocols, clients), then move on to the actual steps for importing a subscription and setting up a client, and only later dig into more advanced topics like line types and rate multipliers. This site's "Complete Beginner's Guide" is laid out in exactly that order — a good place to start.

Not necessarily, but free options generally come with poor stability, slow speed, and higher privacy risk, and are hard to rely on long-term. Most people end up settling on an affordable paid service as their daily driver, keeping free nodes around as an emergency backup rather than their main option.

If you want something that works out of the box with no configuration hassle, start with an all-in-one VPN client. If you're willing to spend ten or fifteen minutes learning the client and subscription-import process, a proxy setup (service + client) generally gives better speed and resistance to blocking — the learning curve isn't steep, and it's the more mainstream choice at this point.

Most clients support "Rule" mode, which you can leave connected all the time without it slowing down access to domestic sites — traffic only routes through a proxy node when you're accessing something that needs it. Whether to leave it on all the time is mostly personal preference; from a data-usage standpoint, turning it on only when needed saves some of your plan's allowance.

Yes — common alternatives include self-hosting your own VPS node, using an all-in-one commercial VPN client, and certain browser-extension-based tools. A proxy-subscription service currently strikes a good balance of value and ease of use, but it's not the only option — which one fits best depends on your technical level and budget.