Can China Mainland access Azure Hong Kong's Server?

Hi Calvyn Lee,

Thanks for reaching out in Microsoft Q&A forum,

Yes, there’s a very good chance that China’s Great Firewall will block or severely disrupt a self-hosted OpenVPN server in Azure Hong Kong when you try to use it from mainland China.

Standard OpenVPN (especially on common ports and protocols) is well-known to be detected and blocked by the Great Firewall. Based on long-standing experience from users and the OpenVPN community, if you set up an OpenVPN server on a VPS outside China (including Hong Kong), it might work for a few days and then get permanently blocked. OpenVPN has been actively blocked in China since around 2012.

Even if you put OpenVPN over TCP on port 443 to look like normal HTTPS traffic, deep packet inspection can still identify and block it over time unless you add strong obfuscation.

Azure workloads in Hong Kong are technically reachable from mainland China, but Microsoft explicitly warns that:

Azure cannot guarantee the availability of VPN protocols from within mainland China, and behavior may differ depending on the ISP and region. Traffic between mainland China and regions outside China is subject to the Great Firewall and related regulations, which can introduce latency, bandwidth limitations, and potential restrictions on certain types of connectivity.

In practice, this means:

• Your connection may work initially, then suddenly stop.
• Performance can be very poor and inconsistent, depending on your city and ISP.
• You cannot rely on a simple OpenVPN server as your only way to access non-Chinese internet while in China.

If you still want to try it

• Run OpenVPN over TCP on port 443.
• Enable obfuscation:
  • Use --tls-crypt or --tls-auth in your OpenVPN configuration.
  • Consider wrapping OpenVPN in stunnel, obfsproxy, or using variants that scramble OpenVPN traffic.
• Test as soon as you arrive in China and be ready with alternatives.

Many travelers find these work better than plain OpenVPN:

• Outline (Shadowsocks-based) servers
• V2Ray/Xray, Trojan, or Shadowsocks with realistic TLS camouflage
• Reputable commercial VPN apps that actively update obfuscation (e.g., Astrill, LetsVPN)

Also be aware that using or operating a VPN in China can be legally sensitive and may require permits; enforcement varies, but personal use still carries some risk.

Official Microsoft documentation links:

• Azure in China – cross-border connectivity and interoperability https://learn.microsoft.com/en-us/azure/china/overview-connectivity-and-interoperability
• FAQ: Frequently asked questions about Azure in China https://learn.microsoft.com/en-us/azure/china/resources-faq
• OpenVPN Support Forum: Work in China? (practical experience with OpenVPN and the Great Firewall) https://forums.openvpn.net/viewtopic.php?t=28364

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Connectivity from mainland China to Azure Hong Kong can vary because traffic may be affected by local network policies.　Azure cannot guarantee the availability of VPN protocols from within mainland China, and behavior may differ depending on the ISP and region.

Workloads hosted in Azure regions outside China, such as Hong Kong, can be accessed globally, including from within mainland China. However, traffic between mainland China and regions outside China is subject to the Great Firewall and related regulations, which can introduce latency, bandwidth limitations, and potential restrictions on certain types of connectivity.

Official guidance for compliant and more reliable connectivity from within China to Microsoft cloud services recommends:

1. Using qualified network/ISP providers that hold an ICP license and offer services such as MPLS/IPVPN, SD-WAN, or Dedicated Internet Access.
2. Establishing interconnects to the Microsoft global network at Hong Kong Internet Exchange points or via ExpressRoute in Hong Kong, often combined with Azure Virtual WAN and secured hubs.
3. Ensuring any VPN or dedicated line used in China is purchased from a qualified vendor with a valid operating license, in line with local regulations.

While a VM-based VPN server in Azure Hong Kong is technically reachable from China, its operation and performance are subject to China’s internet regulations and enforcement mechanisms. For compliant and more predictable connectivity, use provider-based VPN/dedicated line solutions and architectures described for interconnecting China with Azure and Microsoft global services.

References:

• Frequently asked questions about Azure in China
• Interconnect with China using Azure Virtual WAN and Secure Hub
• Data sovereignty and China regulations
• Azure in China checklist
• Global Secure Access support in China