VPN for expats and long-term residents in China

Expats have a different problem than travelers. You do not need a VPN to work for two weeks — you need one that holds up for two years, works silently in the background, handles hundreds of different network environments, and keeps banking, streaming, work tools, and family communication running without daily attention.

This guide covers the setup that long-term residents actually use. It is less about the initial install and more about the daily-driver configuration.

Router-level VPN for the apartment

Most experienced expats run the VPN at the router, not on every device. Reasons:

• Phones, laptops, smart TVs, game consoles, and visiting family members all get covered automatically — no app installs
• The tunnel survives OS updates, reboots, and family members handing devices around
• When it is set up once and working, it stays set up for years

See the router setup guide for firmware options. GL.iNet travel routers are the most common choice for people not already running custom firmware.

Backup VPN on every device

Router-level VPN covers home. For everything else — going out to a cafe, visiting someone's apartment, the airport — install the app on every device as a backup. When the router is down or you are out of the house, the device-level app takes over.

Work and Google Workspace

If your employer uses Google Workspace, everything (Gmail, Calendar, Drive, Docs, Meet) needs a VPN to work from mainland China. The important configuration choice:

• Route work traffic through a server your employer expects — Hong Kong or Tokyo is fine for most, but if your employer uses unusual-location detection in Google Admin, route through a home-country server when logging in
• Set up your work Google account with an authenticator app (not SMS 2FA) so you are not dependent on SIM signal

Banking and brokerage

US and European banks will flag a login from a mainland China IP. The fix every expat knows:

• Switch to your home-country VPN server before opening a banking app
• Use the banking app, log out, then switch back to Hong Kong or Tokyo for daily use
• Enable authenticator-based 2FA on every financial account. SMS-only is a liability

Streaming

Two streaming scenarios:

1. Your home country's Netflix / Prime / BBC iPlayer — connect to a home-country server. Works well; most content catalogs load normally.
2. Local China services — keep the VPN off for Chinese services (iQIYI, Youku, Bilibili, WeChat video). They are built to serve local IPs and will be faster and higher quality with the VPN disabled.

Split tunneling on the router or the desktop client makes this automatic once configured.

WeChat and local payments

WeChat and Alipay are essentials for daily life in China — groceries, taxis, restaurants. Both work fine whether the VPN is on or off, because they are designed to work globally. But:

• WeChat video calls to people outside China may be smoother with the VPN off (they route through WeChat's own global network)
• Alipay QR scanning for payments is faster with the VPN off at checkout
• For everything else — messaging, reading posts — the VPN makes no practical difference

Family and visitors

When family visits for a week, you do not want to teach them a VPN app. Router-level VPN at home handles it automatically. At restaurants and outside the apartment, install the app on their phones before they arrive and set the app's home screen shortcut to connect to Hong Kong with one tap.

Daily-driver checklist for long-term residents

• Router-level VPN at home
• VPN app installed on every phone and laptop in the household
• Hong Kong and Tokyo both favorited
• Authenticator app on all financial accounts
• Split tunneling configured so local Chinese services bypass the VPN
• APK saved on every Android device in case something ever needs a reinstall