China's VPN Crackdown Escalates: The Great Firewall Now Catches Traffic Even Under TLS
In April 2026, Chinese authorities carried out one of the largest operations against VPN infrastructure in years: physically disconnecting thousands of relay servers in data centers, while the deep packet inspection system was upgraded with a model that flags Shadowsocks, V2Ray, and Trojan traffic even when disguised as ordinary TLS. Here's what changed technically, and why simply "wrapping it in TLS" no longer cuts it.
What happened in April
On April 1, 2026, data center operators in China, acting on government orders, physically disconnected thousands of relay servers that powered the Shadowsocks, V2Ray, and Trojan proxy protocols — triggering widespread outages for services built on these technologies. At the same time, an upgraded Great Firewall gained a machine-learning model that analyzes not packet contents (already encrypted anyway) but their "shape." According to industry sources including TechRadar, the classifier can reliably tell this kind of traffic apart from ordinary HTTPS browsing, even when it's wrapped in TLS.
For users inside China, this showed up as a sharp spike in complaints about instability in tools they'd relied on for years: some services stopped working entirely, others kept connecting and dropping throughout the day.
Why "just wrap it in TLS" stopped working
For a long time, disguising traffic as HTTPS was considered a reliable way around blocking: if traffic looks like an ordinary website request, DPI systems let it through. But TLS hides packet contents, not metadata. Packet sizes, timing between them, the byte order of the handshake — all of that stays visible outside the encryption layer and forms a recognizable "fingerprint" for a specific protocol. It's these patterns, not the content, that modern classifiers are trained to distinguish — not whether the traffic is encrypted or not.
Where AmneziaWG does things differently
AmneziaWG — the WireGuard fork that HamikVPN runs on — solves this one layer earlier. Instead of hiding an already-formed packet inside a second layer of TLS, the protocol randomizes packet size and handshake shape before encryption even happens. The result is traffic with no fixed pattern to feed into a classification model in the first place — regardless of whether it's wrapped in anything else on top.
What this means in practice
An important caveat: this isn't a promise that any VPN is guaranteed to work inside mainland China. The April operation hit physical infrastructure first — the relay servers themselves, not just the protocol running on top of them — and that's a layer no client-side trick can fix. But anywhere DPI is actively hunting specifically for VPN traffic — and that's not limited to China — the protocol layer is what decides whether traffic gets flagged as VPN in the first place. That's exactly the problem AmneziaWG was built to solve.