A laptop needs its own plan for China, because the trick that keeps a phone online does not carry over. A travel eSIM lives in the phone; the laptop on hotel Wi-Fi is on Chinese internet, and every app on it that talks to a server abroad will hang. The fix is the same one that works on a phone, a plain connection key pasted into a client that is not tied to any provider, but on a desktop there is one setting that decides whether the VPN covers the whole system or only the browser, and it catches almost everyone the first time.
Below: why the phone's setup does not transfer, which clients accept a plain key on Windows and macOS, the system-wide versus browser-only question, the test to run at home, and what hotel networks do on the ground.
Why the phone's setup does not transfer
On a phone, most travelers rely on a travel eSIM: data exits abroad, filtering never applies. The laptop has no eSIM. It joins hotel or office Wi-Fi, which is an ordinary Chinese connection, and it is filtered like any local line. You can share the phone's eSIM as a hotspot, and it works, but everything the laptop does then comes out of the eSIM's data, and a working day of video calls and cloud sync empties a travel plan quickly. Most people who work on the trip end up with both: the hotspot as a fallback, a VPN on the laptop for the day. How the eSIM side behaves is in Do you need a VPN with a travel eSIM in China.
Choose a client that takes a plain key
Branded VPN apps fail in China for the same reasons on a laptop as on a phone: recognizable protocols and dependence on the provider's servers for updates and configuration. What holds up is a generic client into which you paste a vless:// key or a subscription link, so that nothing about the connection is tied to an app store or a brand. Why that difference matters is the story of VPN apps from the App Store don't work in China.
- Windows: Hiddify or v2rayN. Both accept a key or a subscription link and both can run system-wide.
- macOS: Hiddify or V2Box. Same idea.
- Install two if you can. They are small, and a second client is the cheapest insurance against one of them misbehaving on an unfamiliar network.
Download from each project's official page while you are still at home. Small open-source clients are often unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch; that is expected for these projects, and the right response is to make sure you downloaded from the official page, not to look for a different client on the ground, where the pages will not open.
System-wide or browser-only: the setting that matters
Desktop clients have two modes, and the default is usually the wrong one for travel.
System proxy mode tells the operating system "send web traffic through me". Browsers respect it. Many other programs do not: mail clients, chat apps, terminal tools, sync clients and some video-call apps talk to the network directly and ignore the proxy. The result is a browser that works and a Slack or a mail app that sits on "connecting", with the VPN showing green the whole time.
TUN mode, sometimes labelled VPN mode or system tunnel, creates a virtual network interface and routes everything through it, the way a phone's VPN does. This is the mode you want in China. It usually asks for administrator rights on first use, and on macOS it may ask to install a system extension; do both at home, not in the hotel.
While you are in that screen, set DNS to resolve inside the tunnel, or enable the client's equivalent option. Without it the laptop asks the hotel's DNS where things are, and half of what you open will fail even with the tunnel up.
Import the key and test at home
- Copy your key or subscription link from your provider. With 404 VPN it is the key in your dashboard; a subscription link is better than a single key because it refreshes the list of keys on its own.
- Paste it into the client: "Add from clipboard" or "Import subscription", depending on the app.
- Switch the client to TUN mode and connect.
- Open What Is My IP and confirm the address and country changed. Run the WebRTC leak test and the IPv6 leak test; a laptop on a network with IPv6 can send part of its traffic around a tunnel that only carries IPv4.
- Open the apps you will actually work in, not just the browser, and confirm they connect with the tunnel up.
- Export the configuration, or copy the key into your notes, so that a reinstall on the road does not depend on reaching a website.
On the ground: hotel networks and hotspots
Hotel Wi-Fi in China often starts with a captive portal that asks for a room number or a Chinese phone number. Until you are through it, nothing connects, VPN included; connect first, then start the tunnel. Some hotel networks are filtered more aggressively than mobile data, and a key that works on the phone's local SIM may fail on the same hotel's Wi-Fi. When that happens, the phone's hotspot is the quickest path: it moves the laptop onto the phone's line, eSIM or local SIM, and the VPN behaves as it does on the phone.
Keep the kill switch in mind. At home it protects you: when the tunnel drops, traffic does not fall back to the open network. In China the same behaviour looks like "the internet is gone". If everything stops at once, check whether the tunnel dropped and the kill switch is holding the line, before blaming the hotel.
If you work for a company
A corporate VPN inside a personal tunnel sometimes works and sometimes does not, and whether it is allowed is a question for your IT department, not for a travel guide. Test the combination at home: connect the personal tunnel first, then the corporate one, and see whether mail and internal tools open. If they do not, ask IT before you fly; from the hotel there will be nobody to ask.
If nothing connects
Switch key. Switch client. Move from hotel Wi-Fi to the phone's hotspot. Turn the kill switch off and confirm ordinary internet returns. And on a genuinely bad day, roaming on the phone for a few minutes remains the one dependable way to message home. The symptom-by-symptom version is in VPN not working in China? Fix it by symptom.
404 VPN gives you a vless:// key or a subscription link in your dashboard that works in Hiddify and v2rayN on Windows and in Hiddify and V2Box on macOS, alongside our own Android app for the phone. The free plan is enough to run the whole test above before you fly. We do not promise availability from every network in China on every day; we do recommend setting up at home, in TUN mode, with a second key saved. Start on the home page.