Always on VPN: The Definitive Guide for China (2026)
Struggling with internet in China? Learn why standard Always On VPN solutions fail and how to achieve a truly reliable, high-speed connection for work.
The workday in China often starts with a small gamble. Slack may load, then stall. A Teams call may connect, then freeze when someone shares a screen. Google Docs can sit spinning while a deadline gets closer. The problem isn't only censorship in the abstract. It's the constant interruption of normal business tools that people outside China assume will just work.
That is why so many professionals search for an Always On VPN. They aren't usually asking for a Microsoft feature by name. They're asking for a connection that stays up, reconnects fast, and stops turning every meeting, upload, and login into a troubleshooting session. In China, that distinction matters. The technical product called Always On VPN and the practical goal of an always-on connection are not the same thing.
Table of Contents
- The Daily Disconnect Working Online from China
- What an Always On VPN Is Supposed to Be
- Why Standard Always On VPNs Fail in China
- Achieving the Always On Experience in China
- A Functional Comparison for Users in China
- Best Practices for a Bulletproof Connection
- The Right Tool for a Demanding Job
The Daily Disconnect Working Online from China
A familiar scene plays out every day in Shanghai, Shenzhen, Beijing, and Chengdu. Someone joins a client call on Zoom or Teams. Audio works for a minute. Then video degrades. Then chat messages arrive late. Then the VPN icon shows connected, but nothing useful passes through.
The damage is cumulative. A single drop during one meeting is annoying. Repeating that cycle across logins, approvals, cloud apps, code repositories, and large file transfers turns a normal workday into a series of recovery attempts. People start building routines around failure. They reconnect before every call. They avoid turning on video. They send files early because they don't trust the upload to finish later.
Business users in China rarely want "a VPN" in the abstract. They want predictable access to the tools their job depends on.
That is the practical meaning of an always-on connection in China. It means the laptop wakes up and global tools are available. It means the tunnel doesn't disappear when the network path changes. It means public Wi-Fi, home broadband, and office internet don't each require a different ritual.
For multinational companies, this gets more painful. Headquarters may already provide a corporate VPN and assume the problem is solved. Local staff know otherwise. The client may be technically connected while Outlook, Google Workspace, GitHub, or ChatGPT remains unreliable. On paper, access exists. In reality, work still stops.
The cost shows up in small failures
- Meetings lose momentum: People repeat themselves because voices cut out or screen sharing lags.
- Cloud workflows break: Browser sessions time out, uploads hang, and authentication loops return users to the start.
- Support teams burn time: IT spends hours diagnosing "intermittent issues" that are really path and filtering problems.
That frustration is what drives the search for an Always On VPN. But before choosing a fix, it helps to separate the enterprise product from the day-to-day outcome people need.
What an Always On VPN Is Supposed to Be
Outside China, Always On VPN has a precise enterprise meaning. Microsoft introduced it with Windows Server 2016 and Windows 10 as the successor to DirectAccess, positioning it as an automated remote-access model that connects a device as soon as it has internet access. The architecture supports both device tunnels for pre-logon management and user tunnels for post-logon resource access, as described in this overview of Microsoft Always On VPN and its DirectAccess successor.
The original enterprise goal
The design goal is simple. The user shouldn't need to remember to click Connect. The system applies policy, establishes the tunnel automatically, and keeps managed traffic protected without relying on user discipline.
That makes sense in a corporate environment where devices are centrally managed and remote access is part of security policy, not personal convenience. Teams that need background on the broader business role of secure remote access can also review this primer on what is a business VPN.
Three ideas define the model:
- Automatic connection: The tunnel comes up when internet access is available.
- Policy-driven behavior: IT decides who connects, when they connect, and what traffic the tunnel carries.
- Persistent device coverage: The connection can protect the whole device, not just a browser tab or one app.
Why companies deploy it
In a normal enterprise rollout, this solves a common problem with manual VPN clients. Users forget to connect. They disconnect and don't reconnect. Devices miss access to internal resources until someone notices. Always On VPN reduces that gap by treating remote access as a built-in operating state.
Practical rule: An Always On VPN is less about convenience than control. It gives IT a persistent path to managed endpoints and keeps access rules consistent.
This model also fits modern fleets better than DirectAccess did. It broadens the kinds of Windows endpoints that can participate and gives administrators flexibility around device-based and user-based access.
But that entire design assumes the underlying internet path is basically cooperative. In China, that assumption breaks fast. The tunnel may be configured perfectly and still perform badly because the surrounding network environment treats standard VPN behavior as something to inspect, throttle, or block.
Why Standard Always On VPNs Fail in China
A standard enterprise Always On VPN can be well designed, fully supported, and still fail inside mainland China. That failure usually isn't because the IT team misconfigured Windows. It's because the network environment in China doesn't behave like a neutral transport layer for global traffic.
China breaks the normal assumptions
An enterprise VPN designed for Europe, North America, or Singapore expects that once a device has internet access, it can reach the corporate gateway in a fairly predictable way. In China, that path can degrade without warning. Traffic patterns that look routine elsewhere can attract interference, throttling, or outright failure.
This is why a user can say, "The VPN says connected, but nothing works." The session may technically exist while the actual application experience remains poor. Video calls become unstable. Login flows break. Cloud services partially load. From the user's perspective, the VPN is unreliable. From a network perspective, the tunnel is colliding with an adversarial path.
The protocol problem
For the IKEv2-based implementation commonly used with Always On VPN, the protocol relies on UDP 500 and UDP 4500 for negotiation and NAT traversal. Those ports are frequently blocked or throttled in restrictive networks, causing connection failures. That makes IKEv2-based solutions unsuitable for environments with unpredictable firewalls or deep packet inspection, such as mainland China, as explained in Richard Hicks' analysis of IKEv2 features and limitations for Always On VPN.
That single fact explains a lot of user complaints. A company can standardize on IKEv2 because it's strong and sensible in most managed enterprise environments. Then a team lands in China and the same design starts failing in hotels, coworking spaces, apartments, and some office networks.
For a broader reality check on the issue, this overview of whether VPNs work in China is useful because it frames the problem as one of local network conditions, not just app settings.
Why user frustration looks random
The randomness is what confuses non-specialists. One day Teams works but Google Drive doesn't. Another day Gmail loads while the meeting drops. On a different network, the client won't connect at all. Users think the VPN is flaky. Headquarters thinks local staff are exaggerating. Neither diagnosis gets to the root cause.
A few patterns usually sit behind that chaos:
- Port dependency: Standard negotiation depends on traffic that restrictive networks can disrupt.
- Path instability: A route that works in the morning may perform poorly later.
- Network diversity: Home broadband, mobile hotspots, hotel Wi-Fi, and office circuits don't fail in the same way.
In China, "always on" can't mean only "auto-connect on startup." It has to mean "keeps working when the surrounding network fights back."
That is why standard Always On VPN products often disappoint in China. They were built to automate secure access over normal internet conditions. China is not a normal internet condition.
Achieving the Always On Experience in China
The solution in China isn't to worship the product category. It's to focus on the function. People need a connection that starts quickly, stays usable, and survives the kind of interference that breaks standard corporate VPN paths.
The target is continuity, not product purity
A standard Always On VPN authenticates through RADIUS/NPS after DNS resolution before a tunnel is allowed. A specialized service for China simplifies this to a single sign-in, handling the complex routing and authentication in the background so the tunnel establishes quickly and reliably despite network interference, as outlined in this explanation of Always On VPN authentication flow and China-focused simplification.
That distinction matters more than many IT teams realize. In China, every extra dependency in the path becomes another point of friction. If a service can reduce what the user has to manage while also using a routing model built for local interference, the result feels far closer to "always on" than a formally correct Microsoft deployment that keeps getting disrupted.
What works better in practice
The better approach is usually a service architecture designed specifically for China rather than a generic global VPN stack deployed into China as an afterthought. The user doesn't need to choose protocols, test ports, or retry five gateways. The service should handle route selection and reconnection behavior behind the scenes.
A useful way to think about it is public road versus managed road. A standard VPN often sends traffic into conditions it can't control. A China-specific connectivity service is engineered to keep the route stable enough for actual work. That changes the experience in practical ways:
- Global collaboration tools stay usable: Zoom, Teams, Google Workspace, GitHub, and AI tools are less likely to fail mid-task.
- The setup burden drops: Users sign in and work instead of opening helpdesk tickets about protocol choices.
- Device coverage gets broader: Teams can extend reliable connectivity beyond one laptop by using hardware-based approaches where needed.
For offices or apartments where multiple devices need the same stable path, router-based deployment is often the cleaner answer. This overview of what a VPN router does is useful because it explains how one managed connection can cover a whole local environment rather than relying on separate app behavior per device.
A reliable China setup should feel boring. If users keep thinking about the tunnel, the design still isn't right.
That is the practical definition of success. Not whether the product matches Microsoft's naming. Whether work continues without constant intervention.
A Functional Comparison for Users in China
Not all VPN approaches fail for the same reason. Some are simple but fragile. Some are secure on paper but too dependent on enterprise infrastructure. Some are built around the actual network conditions users face in China.
Microsoft's own documentation makes one trade-off clear. Deploying Always On VPN is not lightweight. It typically depends on enterprise PKI, Network Policy Server, Routing and Remote Access, and dual DNS structures, which increases configuration complexity and is usually managed by central IT, according to Microsoft's Always On VPN deployment overview.
VPN Approaches for China Compared
| Feature | Manual VPN | Enterprise Always On VPN | Throughwire (China-Specific) |
|---|---|---|---|
| Reliability in China | Often inconsistent. Users reconnect manually and hope the route still works. | Better for managed corporate access in normal environments, but often unreliable in China when standard protocols are disrupted. | Built around China use cases and day-to-day continuity. |
| Speed for video calls and uploads | Can vary sharply by location and time of day. | Depends heavily on corporate gateway path and protocol behavior. | Designed for stable access to global work tools. |
| Ease of setup | Usually easy to install, but users often need to switch servers or settings. | Heavy central IT project with certificates, policies, and supporting infrastructure. | Simpler user-side experience focused on quick sign-in and connection. |
| Coverage model | Usually per device and per app session. | Strong managed-device model with policy enforcement. | Can support individuals, teams, and broader coverage depending on deployment. |
| Bypassing restrictive network behavior | Hit or miss. | Often weak in China if the deployment relies on standard, easily disrupted paths. | Purpose-built for restrictive conditions. |
| Best fit | Individuals who can tolerate interruptions. | Companies needing Microsoft-managed remote access outside hostile network environments. | People and businesses in China who need dependable access to global services. |
There is also a protocol design question underneath this comparison. Teams evaluating standard enterprise stacks should understand the trade-offs in IPsec VPN vs SSL VPN approaches, because protocol choice often determines whether the design is resilient or brittle in restrictive networks.
For China-based users, the key decision isn't "enterprise" versus "consumer." It's whether the service was engineered for China in the first place.
Best Practices for a Bulletproof Connection
A reliable connection in China depends on more than the client app. The strongest setup combines the right service architecture, the right traffic policy, and a local environment that doesn't create avoidable instability.
Security choices that matter in China
One of the biggest mistakes is assuming split tunneling is always the smart default. Many Always On VPN deployments use split tunneling to conserve bandwidth, but that can increase security risk on untrusted networks. For users in China, forcing all traffic through a secure, encrypted tunnel is often the better choice for both security and consistent access to global services, as discussed in these security considerations for Always On VPN deployments.
That recommendation matters because China users move across mixed environments all the time. Home networks, hotel Wi-Fi, mobile tethering, and guest office access don't deserve implicit trust. Forced full tunneling reduces the chance that some apps bypass the protected path and then fail unpredictably.
Field advice: In China, split tunneling often saves bandwidth while creating two separate problems at once. More exposure and more inconsistent app behavior.
Operational habits that reduce downtime
The connection itself still needs support. These habits tend to make the biggest difference:
- Use router-level coverage where teams share one location: That avoids managing separate client behavior on every laptop, phone, and tablet.
- Keep clients and operating systems current: Small compatibility issues become much more painful in a restrictive network environment.
- Choose stable local internet first: No VPN can fully compensate for bad last-mile access.
- Maintain a backup path: Redundancy matters when a single route degrades.
Monitoring also helps. When teams can see latency changes and identify where performance starts degrading, they stop guessing. This complete guide to network monitoring is a useful operational reference for anyone trying to distinguish local Wi-Fi problems from upstream path issues.
A bulletproof setup usually comes down to disciplined basics, not exotic tweaks. Strong local connectivity, full tunneling, current software, and a service built for China will outperform a complicated stack that looks elegant in a global architecture diagram but fails in actual use.
The Right Tool for a Demanding Job
For people working online from China, Always On VPN should be treated as a goal, not just a Microsoft feature name. The goal is uninterrupted access to global business tools, secure traffic handling, and a setup that doesn't require daily intervention from the user.
That is why so many standard enterprise deployments disappoint once they hit mainland China. They automate the connection step, but they don't solve the hostile network conditions around that connection. In a calmer region, that may be enough. In China, it usually isn't.
The better question is simple. Does the service keep work moving. If the answer is yes, that is the always-on experience that matters. If the answer is no, the formal product label doesn't help.
Teams and professionals that need dependable global connectivity in mainland China can look at Throughwire as a purpose-built option. It is designed around the practical requirement this article has focused on throughout: staying connected long enough, fast enough, and consistently enough to get real work done.