How to Set Up and Use Surfshark VPN in China

Surfshark is one of the best VPN deals that you will find anywhere.

Surfshark 2 Year Deal

Get 2 Years of Surfshark for only $59

Ok, so it’s a great deal. But here is the big question…

Does Surfshark VPN work in China?

Yes, kind of, but it’s complicated.

Surfshark used to work very well in China with the Shadowsocks protocol. However, they recently discontinued support for Shadowsocks leaving many China users frustrated.

Although the Surfshark Apps may work in China from time to time, it is very hit and miss. In fact, I find that using manual OpenVPN is much more reliable.

However, it does require some manual set up which is not easy for many people.

Surfshark Alternatives that work in China

If you are looking for a more user-friendly VPN to use in China, here are some suggested Surfshark alternatives.

If you are not yet in China, ExpressVPN is the best alternative.

Special Offer for ExpressVPN

Get an additional 3 months free with the annual plan (15 months total). This brings the price down to $6.67 per month for the annual plan.

The problem with ExpressVPN is that they are no longer offering a China accessible website to sign up from if you are in China. So make sure you sign up and download the apps to all your devices before you arrive in China!

If you are already in China and really want to sign up for ExpressVPN, you will need to use another VPN first to access the ExpressVPN website in order to sign up and download the apps. Just make sure you turn off the other VPN before connecting to ExpressVPN.

If you are in China and don’t want to mess around with a second VPN to sign up for ExpressVPN, the best alternative is Wannaflix.

Special Offer for WannaFlix

30% OFF your first billing cycle (valid for all plans)

Signing up to Wannaflix if you are already in China is not a problem because they offer a special alternative website just for that purpose!

Wannaflix is not a traditional VPN. They are using a protocol called V2ray which is a proxy protocol that has become the successor to Shadowsocks. Although it’s not as secure as a traditional VPN, it is very fast and efficient at bypassing the Great Firewall of China (less detectable compared to traditional VPNs or even compared to Shadowsocks).

How to set up Surfshark Manual OpenVPN in China

If you have read this far and still want to try using Surfshark in China, here is my preferred method.

You could always try the Apps first if you want, but doing so will just leave you frustrated in my opinion.

The best and most reliable method of connecting to Surfshark VPN in China is by using Manual OpenVPN files with hard coded IP addresses. Here is my guide on how to do that.

Step 1 – Get your OpenVPN credentials from the Surfshark website

Open the Surfshark website and log into your account

If you are in China, you can use this alternative link to access the Surfshark website.

Once you are logged in, click on Manual setup under the VPN heading, then choose Manual, then Credentials as shown below.

Surfshark website customer area OpenVPN credentials.

Here you will need to copy your Username and Password. Save these somewhere that you can easily access them. You will need to copy and paste these for every connection profile that you set up when you first try connecting.

Step 2 – Make a list of server hostnames

Now that you have your credentials (username and password) saved, make a list of server hostnames for locations that you want to connect to. Click on the Locations heading beside Credentials.

Surshark website customer area locations list.

Each location has a hostname shown under the Country/City name. For example, Albania is al-tia.prod.surfshark.com. Algeria is dz-alg.prod.surfshark.com. The “fastest server” and “nearest country” are both tw-tai.prod.surfshark.com, which is the hostname for Taiwan.

Don’t pay too much attention to the “fastest server” and “nearest country” if you are in China. Due to the way China ISPs route traffic, these are often not accurate.

Copying these hostnames can be tricky because a javascript windows pops up asking you to download the UDP and TCP files once you release the left mouse button after selecting the text. The trick is to press Ctrl+C to copy the name while the text is highlighted, but before you release the left mouse button.

If you are having trouble copying the hostnames, you can also download the UDP or TCP .ovpn file, open the file in a text editor, and then copy the name from there. You will find it on the 3rd or 4th line after the word “remote”.

Build up a good list of hostnames because not all locations will work in China.

Step 3 – Download a sample UDP and TCP file

It doesn’t mater which location you choose, you just need 1 UDP and 1 TCP file to use as a template to start with. The files for each location are the same, the only difference is the hostname which we will delete and replace with an IP address later.

To download the files, just click on any of the locations and then click Download TCP and Download UDP. Save the 2 .ovpn files on your computer.

Step 4 – Find IP addresses that are not blocked in China

This is the tricky part. If you don’t want to do this yourself, you could check the bottom of this page for some recommended IPs that I found to be working the last time this page was updated.

To find working IPs, choose a server hostname that you collected in Step 3 and paste it into the OpenDNS CacheCheck website.

For example, here are the results for the USA – Seattle location (hostname us-sea.prod.surfshark.com)

OpenDNS cache check website. Result of Seattle location hostname.

You will find many different IP addresses here, some are duplicates. You will have to go through and find ones that are not blocked in China.

You can check if the IP is blocked in China by sending a ping command. Make sure to turn off any existing VPN connections because you need to ping directly from China.

If you don’t know how to send a ping command, refer to this article for instructions.

If the IP is not blocked in China, your ping result will look like this.

Output of Surfshark Shadowsocks server successful ping

If the IP is blocked in China, then your ping result will look like this.

Output of Surfshark Shadowsocks server unsuccessful ping

If you are not yet in China, or using a mobile device, or don’t want to send ping commands there is an alternative. You can check the IP addresses on the ping.pe website.

If an IP address is blocked in China, you will see 100% packet loss from the mainland China locations, as shown below.

Ping.pe output for an IP which is blocked in China.

If the IP is not blocked in China, then you will see packet loss under 100%, as shown below.

Ping.pe output for an IP which is not blocked in China.

In China some packet loss is normal so don’t be worried if the packet loss is not 0%. As long as it’s not 100% then the IP is not blocked.

The lower the ping time, the better. Try to find server IPs with a low ping time. It’s always better to ping directly from your ISP in China if you can because the ping time shown on ping.pe results will not be the same as your actual ping.

Build a list of all the IPs that respond to a ping. It’s possible that some IPs will respond to ping but still not work, so try to find as many as possible before going to the next step.

In this example for Seattle, there was a total of 24 unique IP addresses for the us-sea.prod.surfshark.com hostname. Of those 24, I found that 17 were blocked and 7 were not blocked.

To illustrate the next steps I will use the 138.199.12.50 IP address, which was 1 of the 7 unblocked IPs.

Step 5 – Create your OpenVPN config files

Open one of the .ovpn files that you downloaded in Step 3. I will use UDP in this example but you can also do the same steps for TCP. In general UDP will give you faster speeds but sometimes TCP can work better on certain networks.

After opening one of those files, make the following 2 changes.

  1. If you are using Windows 10, add an additional line with the text block-outside-dns. If you are not using Windows 10+ then you can skip this step.
  2. Replace the hostname with an IP address from your list in Step 3.

For example, here is the original UDP file downloaded from the Surfshark website.

Original OpenVPN config file from Surfshark website (Seattle location)

After making the changes, here is what the file should look like.

Modified OpenVPN config file with direct IP and block-outside-dns line.

Now that you have made the changes, save as a new file and give it a name to identify it by. For example, you could call it “Surfshark-Seattle-UDP-custom-IP.ovpn”.

Make sure that the file extension is .ovpn. Some text editing programs may add .txt to the end of the file. If that happens you will need to edit the file name to remove the .txt at the end.

Now change the IP address in the file to a new one from your list and save it again with a new name. Make 1 UDP file and 1 TCP file for each IP that you found in Step 4.

Step 6 – Install OpenVPN and import your files

Here are the links for the relevant apps for different platforms.

Windows

OpenVPN GUI

Alternatively, you can download the client using the links below if you are in China and cannot access the OpenVPN website.

Download OpenVPN GUI v2.5.0 for 64bit Version

Download OpenVPN GUI v2.5.0 32bit Version

Mac OS

Tunnelblick

If you are in China without another VPN, you can download Tunnelblick using the link below.

Download Tunnelblick v3.8.4

Android

OpenVPN Connect

OpenVPN for Android (alternative)

If you are in China without another VPN and cannot access the Play Store, download the OpenVPN for Android by Arne Schwabe app below.

Download OpenVPN for Android by Arne Schwabe v0.7.21

iPhone and iPad (iOS)

OpenVPN Connect

If you don’t see this app in the App Store then your Apple ID is probably tied to a Chinese address. Follow these instructions to access the US version of the App Store in China.

If you are not sure how to use these apps, you can follow the guides on the Surfshark website, just remember to use your .ovpn config files created in Step 5 instead of the ones downloaded directly from the Surfshark website.

Remember to enter your credentials from Step 1 the first time you connect to each location (you can choose to save your credentials so you don’t have to enter them every time).

You can also check my guide on how to set up manual OpenVPN with ExpressVPN for reference. In that guide I go into more details on how to use the different apps.

Tips for using OpenVPN connections on Android and iOS Devices

The easiest way to edit the OpenVPN config file is to download the file on a computer, make the edits, save the file, then transfer it to your device (for iOS you can email it to yourself because transferring by USB doesn’t seem to work).

Alternatively, if you don’t have a computer available, you can use a text editing app to edit the file directly on your device.

For iOS, I recommend the Documents by Readdle app. First install both the OpenVPN Connect app and the Documents by Readdle app. Then download the OpenVPN config file from the Surfshark website using Safari. Instead of Opening it with OpenVPN, choose “More…“, and then choose “Copy to Documents“. This will open the file in the Documents by Readdle app. After you you make the edits, tap the symbol in the top right and then choose Share. Then choose “Copy to OpenVPN“.

Android is much easier to work with, so you don’t need to follow specific steps like you do with iOS. There are many text editing apps available for Android that will work. Personally, I like the Just Notepad app.

Simply download the config file to your Android device, edit it with any text editing app, save it to your device, then import it into the OpenVPN Connect app.

Surfshark Working IP Addresses (Feb 13, 2022 updated)

In order to save you some time hunting for IP addresses that are working in China, I will list a few here and try to keep the list updated as best I can. If you find that any of these are no longer working, please leave a comment.

USA Seattle
138.199.12.50
212.102.46.39

Canada Vancouver
104.200.132.35
107.181.177.179
198.8.92.74
208.78.41.200
66.115.147.82

Taiwan
103.152.151.67
2.58.241.3

Japan Tokyo
138.199.22.148
89.187.160.132


Leave a comment

 

Reader Comments (70)

  1. I have to say it is the best guide for the beginer. Thanks for you work.
    One question confused me for a long time I have ask. In iOS, we can download iKEV2 certificate from Surfshark or install “OpenVPN connect” from Apple store. I prefer the later one. However, whatever any one, they do not have “connect on demand” option, which will make disconnect from Surfshark server after locking screen. If you are using google voice to waiting for a call etc. that will make a trouble for you. I searched for some articles to solve this problem. It is said we could install an app called”apple configurator 2″ to rewrite the UDP file. Unfortunately, we have to own an apple business manager account to log in. Apparently, I do not have this account.
    So my question is how can we own “connect on demand” option on iPhone with using Open VPN app.

    Reply
    • That’s strange, I’ve never heard of that problem with OpenVPN Connect before. But I use an Android phone so I’m not very familiar with iOS.

      If you don’t find a better solution you could try using the Wannaflix V2ray service, which isn’t actually a VPN but a proxy. I heard it works very well with the Shadowrocket app on iOS.

      Reply
  2. Hi James,

    Thanks for the tutorial. I have seen people commenting that openVPN is easy to be detected by GFW, do you think it is safe to use openVPN? Thanks

    Reply
  3. I can use only Open Vpn with UPD in china.
    It was also provided through chatting with a limited list of servers that could be accessed

    Reply
    • Wow, you are right! Surfshark is no longer offering Shadowsocks at all. Very disappointing news. I will update this page as soon as possible.

      Reply
      • Any other alternatives you would recommend? I got my Surfshark but realized it is no use after entering China

        Reply
        • Sorry for not keeping this page up to date. I am updating it now. Surfshark is no longer supporting Shadowsocks. You can try connecting through the Apps or try manual OpenVPN using the methods shown on this page. I will do some testing today and update this page with the latest solutions (if any).

          If you are already in China, I suggest you try Wannaflix. They are using V2ray which works much better than traditional VPNs in China. ExpressVPN is also working, but their website is not accessible in China which makes it difficult to sign up if you are already here.

          Reply
  4. For shadowsocks, seems like Seattle, Hong Kong, Taiwan, and maybe Tokyo do not work any more

    Reply
  5. here is I found IP works in China
    London – 185.44.76.188
    Turkey – 185.195.79.3
    Bulgaria – 217.138.202.21
    Kazakhstan – 45.136.56.64
    Germany – 45.87.212.182
    Germany2 – 45.87.212.180
    Germany3 – 45.87.212.184

    Reply
  6. I have found a few servers but snail speed
    1. 84.247.49.20 Singapore
    2. 185.195.79.3 Paris
    3. 185.44.76.188 Paris

    Reply
  7. I have one problem: the shadowsocks function sometimes gets disabled on www, and I need to enable it again. After that the remote port and password are changed. Currently I have maybe 200 different servers in my Shadowsocks app (Android). Is there a way to change the port and password to the new one in all those servers at once? Is there a shadowsocks client that can do that? It is terrible to change those two settings in 200 servers one by one…

    Reply
  8. All SS connections are blocked after 3 minutes from the time you connect. Right now the only option is Open VPN. SurfShark support can send you udp/tcp configuration files.

    Reply
  9. @James this blog is amazing. Helped me a lot to set up Surfshark. Thanks for taking the time to write this and update.

    I mostly use Shadowsocks and OpenVPN. The app (windows and android for me) only worked here and there last month with lower speed.
    Taiwan and Japan servers are the best but none are working now.

    Tried the IPs you shared today but can’t ping any.
    So far I only have one working IP in Albania sent by Surfshark support:
    31.171.152.195 on OpenVPN or 31.171.152.196 on SS

    Reply
    • The servers I found yesterday were all blocked after I updated the page. I have found some new ones and have updated again.

      Reply
  10. Seems like all the IP addresses cant be pinged from China. The new ones also all dont work. Looks like Surfsharks shadowsocks service has been completely blocked in China

    Reply
  11. I’m uncertain if Shadowsocks is even doing anything on my computer. I just disabled it from my account to try and reset the port. and I thought, before I reenable it, let’s see what happens if I try to use it… nothing is different. the shadowsocks app is on, says I’m connected, pings all my servers even better than when I had it turned on, I can still browse the web. Shouldn’t it be… disabled. Shouldn’t my internet be not working?

    Reply
    • Sometimes the Shadowsocks credentials still work on some servers even after disabling SS on the Surfshark website. To confirm if Shadowsocks is working, you can load a blocked site such as Google, Facebook Youtube, etc. Or go to a website that shows your IP address and location such as https://whatismyipaddress.com/.

      Reply
  12. I don’t know if I have the wrong expectations or what. I’ve tried IPs in USA, Japan, Hong Kong, Malaysia… I get pings, when I connect to the servers, I can browse normal unblocked sites like ecosia.org but nothing is unblocked unless I flip on my vpn. I came here because my vpns are too unreliable and I had heard that Shadowsocks was a more complicated but more reliable way of getting around the GFW. How do I know if it is working? if any website loads? if Google.com loads?

    Reply
  13. Hi James,

    I think a few of the servers just got blocked. I can’t ping them using shadowsocksR. I’ve changed the last digits of the server addresses until I got a ping, connected to them but they can’t seem to provide an internet connection (‘no address associated with host name’).

    Reply
    • Yes, some IPs were blocked. I’m updating the list now with some working ones.

      Reply
  14. happy lunar new year.

    the newIP 103.51.140.73 is much lower latency than the 103.98.x.x… very good tip.~

    any new ip for the japan which lower latency than the 45.87.213.104??

    Reply
  15. Hey James, any quick way to share the whole server list between shadowsocks pc and android? Or alternatively, update all the port and credentials at once :‘)。

    Reply
    • I can only find a way to export the servers on Windows one by one. You could try to paste each ss:// link into a list and then try importing them into Android all at once.

      Reply
  16. Am I the only one having issues with surfshark (shadowsocks) on mobile phone? Recently all of my connections are down (4 android + 4 ios), I use the exact same setup on PC and MAC they work flawlessly. I then deleted the shadowsocks app (android) and scanned the qr code from PC client still getting bad results. On the same app I have other profiles from my own VPS and they also work with no issue. So I assume this is a problem from surfshark servers? or anyone else having the same problem? Cheers

    Reply
    • Sounds strange. I can’t test mobile right now because I am outside of China and only have access to my computer by remote access. Maybe someone else can comment? I don’t see any reason why it wouldn’t work. Maybe try a different mobile device and/or different network to narrow it down.

      Reply
  17. Hey James,

    great tutorials and guides, I like that you focus on latency more than any other site.

    I am having real trouble with getting any Ip’s to accept a ping. I am going to try at home as the connection at home seems dramatically faster than I have here.

    How do you get such low latency with surfshark is it using the shadowsocks or the vpn?

    Reply
    • Try IP 103.51.140.73 with a manual Shadowsocks connections. The 103.51.x.x range IPs have lower latency than the 103.98.x.x range (different host). I’m getting around 30ms right now with 103.51.140.73 on a Guangdong China Telecom connection.

      Reply
  18. How do you edit the config file? I’m currently in China and have tried to edit it on notepad which doesn’t save the changes as well as on Firefox which won’t allow me to make changes

    Reply
    • Notepad should work fine, but you may need to provide admin access if you are editing it directly from the config folder in the program files directory. I would edit it first in a normal folder and then paste it into the config folder.

      Reply
  19. Hi, I am using both, the application for Windows and Android withouf flws at this moment in CHina. I have not checked the speed though

    Reply
  20. You say the Surfshark app from the Play Store doesn’t work in China, so I downloaded the apk from Surfshark’s website like you said. But when I try to install the apk, it refuses to install and says “corrupt flow”
    I will be in China tomorrow, so I’d like to get this fixed.

    Reply
    • I have never heard of that kind of error before. Maybe the file got corrupted when you downloaded it. Try downloading it again as see if it installs. If it fails again, contact Surfshark support. I believe the live chat on their website is back online now.

      Reply
  21. Hello.
    On Android have some special setting?
    I use in these days. Seems fast but not work at all. Like some video have problem. Also iptv have some trouble

    Reply
  22. TW servers are back. But the connectivity is not so good. Often disconnects. However it might be China Mobile’s crappy 4G system’s fault. Do guys with China Unicom have a similar problem these days?

    Reply
    • Are you using Shadowsocks or VPN? GFW seems to be targeting Shadowsocks these past few days. SS connections are unreliable on all 3 ISPs for me. After using the same server for a few minutes it gets temporarily blocked for a few minutes. I have to keep switching servers back and forth. I suggest using VPN connections during this time. The latest version of the Surfshark apps are working in China now, so you could try that. Or manual Openvpn.

      Reply
  23. hello after see your topic i buy it. and dosen’t work for me. i am in china try to connect taiwan and also japan without result

    Reply
    • All of the Taiwan servers were blocked yesterday. Check the IP list at the bottom of this page for currently working IPs, or follow the instructions and find some yourself that respond to pings. You can also try the Surfshark app, the Portugal Porto and UK locations are working with the Surfshark apps.

      Reply
  24. Hi I can`t log in to surfshark vpn in China I have 2 years subscription. If I want to use your methods firstly I have to login to app. Please help me to solve this

    Reply
    • No, that is not correct. My methods are not using the app. Read the instructions more carefully.

      Reply
  25. hello there james , i have found some working ikev2 and openvpn ip addresses for japan servers
    which are as follow
    45.87.213.3
    45.87.213.5
    45.87.213.245
    45.87.213.83
    i have a found a new tool called pinkie to ping the ips and know which ones are working

    Reply
  26. So I have Surfshark Shadowsocks working great on my home wifi (China Telecom) on iOS, but for some reason the same configuration doesn’t work when on 4G (China Mobile). I’m using Shadowrocket, and when on 4G the ping test shows all servers returning pings, but turning on the proxy it seems like they are all blocked. I’ve tried IPs for Japan, Taiwan, LA, Montreal, etc. all have the same behavior. I think it must be something with my app configuration and not the servers themselves, but it’s just so strange that they all work on home wifi but none of them work on 4G.

    Any thoughts on how to troubleshoot this?

    Reply
    • China Mobile often doesn’t work well with VPN and Shadowsocks connections. I would suggest using China Unicom if possible.

      Just to confirm, the servers work on the same iOS device when connected to WiFi, but stop working when using mobile data?

      You can try putting your device in Airplane Mode for a few seconds to reset your data connection, then try again.

      Reply
      • Yes, the same iOS device for both wifi and 4G. It seems to work intermittently on 4G but I can’t seem to reproduce it – some combination of airplane mode and resetting the proxy, but not as easy as just doing both.

        It seems strange that China Mobile would somehow have an upgraded version of the GFW – or do you think it’s something else?

        Reply
        • I have found that using a VPN or Shadowsocks with China Mobile can be very hit and miss. It often depends on the specific cell tower that you are connected to. In some locations it works fine, but in other locations it can be like you describe. China Unicom is much better.

          Reply
  27. Hi James, many thanks for the information, it is really helpful.

    Using your method, I was able to get the Surfshark service running on my Mac and iOS. But it just could not connect on my Windows 10 PC, I did include the “block-outside-dns” line to the configuration file.

    Below are some of the log lines, any suggestions regarding these?

    Sun Oct 27 12:58:53 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
    Sun Oct 27 12:58:53 2019 TLS Error: TLS handshake failed
    Sun Oct 27 12:58:53 2019 SIGUSR1[soft,tls-error] received, process restarting
    Sun Oct 27 12:58:53 2019 MANAGEMENT: >STATE:1572152333,RECONNECTING,tls-error,,,,,
    Sun Oct 27 12:58:53 2019 Restart pause, 5 second(s)
    Sun Oct 27 12:58:58 2019 WARNING: –ping should normally be used with –ping-restart or –ping-exit
    Sun Oct 27 12:58:58 2019 NOTE: –fast-io is disabled since we are running on Windows
    Sun Oct 27 12:58:58 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]193.148.17.85:1194
    Sun Oct 27 12:58:58 2019 Socket Buffers: R=[65536->65536] S=[64512->64512]
    Sun Oct 27 12:58:58 2019 UDP link local: (not bound)
    Sun Oct 27 12:58:58 2019 UDP link remote: [AF_INET]193.148.17.85:1194
    Sun Oct 27 12:58:58 2019 MANAGEMENT: >STATE:1572152338,WAIT,,,,,,

    Reply
    • When you add the block-outside-dns line, make sure you enter it before the line. I can’t think of anything else that would cause this error.

      You can send me your .ovpn config file by email and I can take a look at it for you.

      Reply
  28. Hi James, Thanks for the info.
    I have been using Surfshark with Shadowsocks for a few weeks after reading your recommendation. I use it as my secondary option for browsing the internet and I couldn’t complain much given how cheap it costs. However, I found it unusable time after time even though the IPs were 100% pingable. (I use your method of locating the accurate ip address, and then +1).
    I later discovered that the port number you are given at the Surfshark page is also relevant as you will need to have both a pingable ip and a working port number for that specific ip to set up your Shadowsocks! I use http://www.yougetsignal.com/tools/open-ports/ to check if the port number I am given is open. Without a working port number, Shadowsocks will fail regardless of a pingable ip.
    My overall experience with this set up has been unstable, these port numbers seem changing all the time, a working port number might close after a few days, I then had to disable/enable to find a working pairs. It’s a little annoying, but you can what you pay for.

    Reply
    • Thanks for your comments. I have also found the same problem with my credentials not working and having to reset them on the website. I don’t think the problem is related to the port getting blocked in China, but rather an issue with Surfshark’s server management. I say this because when my credentials stop working, the SS connection also fails when connected to a VPN (Shadowsocks over VPN). Your port tool seems to confirm this as well.

      I agree with you that it can be annoying. But I’m not going to complain too much when paying $47 for 2 years and getting very high speeds on the Japan/Taiwan servers.

      As this manual Shadowsocks method is new, hopefully the problem is temporary and they will improve their server/port management soon. One good thing about this is that few people will be using these servers (due to not many people knowing my method of finding them and the problem with credentials/ports). That means they are unlikely to get blocked. If these servers were easy to use then everybody would be using them and they would all get blocked pretty quickly.

      Thanks for sharing the website to check the ports. Very useful!

      Reply