Back to blog
Business

Office Internet in China: VPN Apps, a Router or a Leased Line?

A neutral guide for 5 to 50 person offices in China: VPN apps, an office router, a licensed leased line, SD-WAN or local cloud, with sourced costs.

Updated October 2026.

阅读中文版

The short answer

For a foreign company office of 5 to 50 people that mainly needs Google, Microsoft 365, Zoom and Slack, one office VPN router with smart routing covers every device the same day. A cross-border leased line from a licensed carrier is the right answer when compliance requires it, but expect a two to four month lead time and four-figure monthly bills.

Table of contents

What are the options for office internet in China?

There are five realistic ways to give an office in mainland China working access to international tools. They solve different problems, and they can be combined.

  1. VPN apps on each device. Every phone and laptop runs a VPN provider's app.
  2. One office VPN router with smart routing. International services go through an encrypted connection, Chinese services stay on your normal line, and every device on the Wi-Fi is covered.
  3. A cross-border leased line (IEPL or IPLC). A private international circuit from a licensed Chinese carrier, or a partner reselling its capacity, linking your office to your own network abroad.
  4. SD-WAN and cloud networking. Managed services that link your offices and cloud systems, such as Alibaba Cloud's cross-border Cloud Enterprise Network (CEN) or Cato.
  5. Local cloud for China-facing systems. Hosting your website or app inside mainland China.

Options 1 to 4 are about your staff reaching the world. Option 5 is about people in China reaching you.

Every path into mainland China ends at an international gateway run by one of three licensed carriers, China Telecom, China Mobile and China Unicom, according to a July 2026 connectivity guide from TechDirectory. Foreign providers can partner with them but cannot run their own cross-border line.

How do the options compare?

Prices are our own (October 2026), list prices checked on 23 October 2026, or vendor benchmarks labelled as such. No carrier publishes China circuit prices.

OptionBest forTypical costPaperworkWhat it coversWeak point
VPN apps on each device1 to 5 people who travelThroughwire Personal from $49 a month (100 GB, up to 3 devices). Astrill lists $30 for one monthNoneDevices with the app switched onEvery device is a separate job. TVs and meeting-room screens can't run apps
Office VPN router5 to 50 people in one officeRouter bought once, plus Throughwire Team from $199 a month (400 GB, 50 seats)NoneEvery device on the office Wi-Fi or cableCovers one network. Not a licensed carrier line
Cross-border leased line (IEPL or IPLC)Regulated firms, large sites, compliance-led companiesVendor benchmark: about $1,200 to $2,500 a month for 10 Mbps, Hong Kong to Shanghai (DCConnect 2026 Asia benchmarks via TechDirectory, July 2026, not quotes)Carrier contract, business licence, internal-use commitmentTraffic to your own network abroadHigh price per Mbps, 8 to 16 week lead time
SD-WAN or cloud networking (Alibaba Cloud CEN)Linking offices and cloud systemsQuote-based. CEN cross-border is a subscription paid to China UnicomBusiness licence, organisation code certificate, authorisation letterYour own systems in and outside ChinaInternal systems only. Some vendor terms forbid bypassing the firewall
Local cloudWebsites and apps for customers in ChinaCloud usage pricingICP filing for each domainPeople in China reaching youDoes nothing for staff reaching Google

TechDirectory says its circuit figures are "third-party benchmarks that establish order of magnitude for budgeting; they are not quotations."

When is a cross-border leased line the right answer?

A leased line from a licensed carrier is the right choice, and a VPN router is not, when:

  • Your industry is regulated. Banks, insurers, asset managers, healthcare firms and listed companies often have to show auditors exactly how data leaves China. A contract with a licensed carrier is the documented answer.
  • Your compliance team requires licensed carrier lines. If group policy says so, that settles it.
  • The site is large or the traffic is constant. Hundreds of staff, a factory, or round-the-clock replication to a data centre abroad.
  • You need a private path to your own systems. ERP, file servers or a headquarters network that should never cross the public internet.

Microsoft's guidance points the same way for large Microsoft 365 users. For China-based staff on a global tenant, it recommends a private network carrying Microsoft 365 traffic to an exit outside China, naming Hong Kong, Singapore, Japan and South Korea as examples. It tells companies to "consult regulatory requirements" and says "Microsoft has no recommendations on the use of SDWAN or VPN solutions" (Microsoft Learn, updated August 2026).

What to expect:

  • Lead time. TechDirectory gives 8 to 16 weeks as typical for an IEPL, and says the Chinese carrier's site survey is "the gate that slips most often."
  • Scope. Under China's 2017 rules, international private lines are for the customer's internal office use (see What does the law say?). Ask your carrier in writing what your line may carry.
  • Where to buy. Carriers sell through their international arms, for example China Telecom Europe's IEPL, or through partners.

What does an office VPN router do that apps don't?

An office router suits the common case: a small or mid-size office whose staff need international tools every day, with no IT department and no appetite for a three-month project.

  • Every device is covered. Laptops, phones, meeting-room screens and visitors' devices only need to join the Wi-Fi.
  • Chinese apps stay on your normal line. WeChat, WeCom, DingTalk, Alipay, Taobao, JD.com, Baidu and Amap go direct, stay fast and don't use your plan's data.
  • International tools go through Throughwire. Google Search, Gmail and Workspace, Microsoft 365 and Teams, Zoom, Slack, GitHub and LinkedIn go through automatically, as does anything not identified as China-local. Our routing directory lists each service.
  • Setup takes minutes, not months. Plug the router into your existing modem, finish GL.iNet's first-time setup at 192.168.8.1, create a one-time router code in your Throughwire account, then run the one command shown for Mac or Windows from a laptop on the router's Wi-Fi. The setup tests itself, and near the end you choose a route: Los Angeles (recommended), or Osaka or Singapore as Ultra.
  • It looks after itself. Signed updates, refreshed China lists, and it reconnects after power cuts.

Throughwire Team starts at $199 a month for 400 GB with 50 team seats on one bill, so staff can also use the apps on their phones outside the office. You buy the router once; we recommend the GL.iNet Flint 2 (GL-MT6000) for most offices.

Evenings are when most offices notice problems. In our network data for the 30 days to 19 October 2026, the median working speed on our High Speed route during China's evening peak (19:00 to 23:59) was 98% of the rest of the day. Peak bursts were lower in the evening (median top speed 50 Mbps against 80 Mbps at other times), so everyday work held steady while the fastest bursts dipped. See our network stats.

A router is an encrypted connection over your ordinary broadband, not a carrier circuit. Throughwire is not licensed or approved by Chinese authorities and does not sell leased lines.

What about SD-WAN and cloud networking?

SD-WAN and cloud networking link your own sites and systems. Read what each vendor says about China before signing.

Alibaba Cloud CEN cross-border. Alibaba Cloud's FAQ says "the cross-border services are operated by China Unicom." It asks for a Business License and Organization Code Certificate, a certificate for the person handling the order and a Letter of Authorization (Alibaba Cloud FAQ). The service agreement limits use to linking the customer's own internal systems, forbids connecting the line to the internet (clause 4.4) and forbids subletting. Good for linking cloud systems, not for general web access.

SASE and SD-WAN providers. Cato says its service is available in China, but "egressing certain traffic to bypass the Great Firewall of China to a non-China Cato POP violates the Cato MSA" (Cato knowledge base, updated 23 September 2026). Ask other vendors the same question directly.

An SD-WAN contract connects your systems. It does not by itself give staff permitted access to Google or Slack.

Do you need local cloud for China-facing systems?

If customers in China use your website, app or portal, host it inside mainland China. This is separate from how staff reach international tools.

  • Azure operated by 21Vianet is separate from global Azure. Microsoft says "Azure in China regions are disconnected from Azure global regions" and recommends hosting workloads aimed at Chinese users there (Microsoft Learn).
  • Cloudflare China Network runs in mainland data centres operated by JD Cloud, as a separate subscription for Enterprise customers. It needs "a valid ICP (Internet Content Provider) filing or license for each apex domain" (Cloudflare docs).

Local cloud does nothing for your staff reaching Gmail or Zoom.

Which option fits your office?

Go down the list. The first "yes" points to your main option.

  • Does a regulator, auditor or parent company require a licensed carrier line? A cross-border leased line.
  • Do you need a private path to your own servers abroad? A leased line, or CEN if your systems are on Alibaba Cloud.
  • Do customers in China use your website or app? Add local cloud and an ICP filing.
  • One office of 5 to 50 people who mainly need Google, Microsoft 365, Zoom and Slack? An office VPN router.
  • Two or three people, often on the road? VPN apps.

Mixes are normal: a router for the office Wi-Fi, apps on team seats for phones on the move, and local cloud for any China-facing website.

What does the law say?

The Ministry of Industry and Information Technology (MIIT) notice of 17 January 2017 (信管函〔2017〕32号) says that without approval from the telecoms authority, no one may set up or rent private lines, "including VPNs", or other channels to carry out cross-border business operations. It adds that international private lines leased by carriers are for the customer's internal office use only (CAC copy of the notice).

So a licensed carrier line used for internal office work is the formally approved route for companies. Other VPN services sit outside that framework. Throughwire is not licensed or approved by Chinese authorities.

Reported enforcement has mostly involved individuals. In 2023, police in Chengde confiscated 1,058,000 yuan of income from a programmer who used a VPN for overseas work, plus a 200 yuan fine (China Digital Times). A draft cybercrime law published on 31 January 2026 would allow fines of up to 5 million yuan, according to Human Rights Watch.

We did not find a published case of a company being penalised for staff VPN use. That is not a guarantee. If your company needs a formal position, ask a lawyer qualified in China.

This is general information, not legal advice.

When Throughwire isn't the right choice

  • A regulator, auditor or parent company requires a licensed carrier line. Contract a leased line through China Telecom, China Unicom or China Mobile, directly or through a partner.
  • You need private access to your own data centre. A leased line or Alibaba Cloud CEN is built for that.
  • You serve customers in China. You need local hosting and an ICP filing, which we don't provide.
  • One or two people on a short trip. An app-only service may cost less. Astrill lists $30 for one month or $180 a year, with unlimited devices in a household (Astrill pricing, checked 23 October 2026).
  • A large campus with its own network team. Talk to a carrier first, and to us about Enterprise for what a carrier line doesn't cover.

Common questions

What is the difference between IEPL and IPLC?

Both are private international circuits sold by licensed carriers. An IPLC is a dedicated circuit at the lowest network layer; an IEPL gives the same private path with an ordinary Ethernet connection, which is easier to plug into office equipment. TechDirectory calls IEPL the default for most enterprise buyers in 2026.

Can we use a leased line and a VPN router together?

They do different jobs. A leased line carries traffic to your own network abroad; a VPN router covers the office Wi-Fi for international web tools. If you run both, ask your legal and compliance advisers how each should be used.

How much does an office router with Throughwire cost?

The router is a one-off purchase, and Throughwire Team starts at $199 a month for 400 GB with 50 seats (October 2026). Extra data can be added mid-month, and every paid plan has a 7-day money-back guarantee.

Is Throughwire a licensed cross-border line?

No. Throughwire is an encrypted service over your normal broadband, not a carrier circuit, and it is not licensed or approved by Chinese authorities. If you need a licensed line, contract one with a carrier.

Details for your IT team

  • Runs on GL.iNet stock firmware with no reflashing, or on OpenWrt 24.10 and 25.12 (arm64 or armv7, 256 MB RAM minimum).
  • The router runs sing-box and connects with VLESS-REALITY over your existing broadband. It is an overlay, not a layer-2 circuit.
  • Mainland China domains and IP ranges go direct; everything else goes through Throughwire. If the tunnel stops, the router holds traffic back and reconnects automatically. Lists and updates are signed.
  • Zero-Trust Relay lets you run your own encryption (Tailscale, WireGuard, SSH or Cloudflare Tunnel) inside Throughwire. We carry it without access to its private contents.