A Bare Debian Server, On An Address No List Has Published
We build you one Linux server outside China and configure it to look like ordinary encrypted web traffic rather than like a VPN. No app store listing, no subscriber list, no shared address, and no company logo attached to the thing you are connecting to.
Commercial services fail there for a reason that has little to do with encryption. Their server addresses are published to millions of customers, which makes them trivial to collect and block, and their handshakes have a shape that filtering equipment learned to recognise years ago.
Why The Paid Apps Stop Working
They fail because of scale, not because of weak encryption. A service sold to millions of people has to hand all of those people the same set of server addresses, and that list is just as available to the people running the filtering as it is to a paying customer. Everything below follows from that one fact.
The Server List Is Public By Design
A commercial provider cannot hide its servers, because customers have to connect to them. Anyone can take a trial, open the app, and write down every address it offers. Blocking the service is then a database update rather than a technical challenge, and it happens to every address at once.
The Handshake Gives It Away Without Being Decrypted
Filtering equipment does not need to read your traffic to know what kind of traffic it is. The opening exchange of a standard VPN protocol has a recognisable size and structure, and equipment sitting on a border link has seen that pattern billions of times. Strong encryption protects the contents and does nothing about the shape of the envelope.
A Suspicious Server Gets Knocked On
When something looks like a tunnel, the connection can be flagged and the server itself contacted afterwards to see how it behaves. A machine that answers like a proxy confirms the suspicion and joins the list. This is why the configuration matters more than the software you pick, and why a server has to look and behave like an ordinary web host to anything that comes asking.
One Address Failing Takes Thousands Of People With It
On shared infrastructure your connection dies at the same moment as everyone else's, usually in the same week that everyone else is complaining about it in the same forum thread. Working endpoints attract a crowd too, and a crowd is exactly what makes an address worth looking at.
You Cannot Always Install Or Update The Client
VPN applications are not available in the Chinese app stores, so arriving without one already installed is a problem, and needing an update while you are there is a bigger one. A configuration file sitting in your email does not have that failure mode, because the client software is generic and the details are yours.
Reverse every one of those and you get the setup on this page. An address that appears on no list, traffic shaped to look like the ordinary web, a server that answers strangers the way a website would, and a failure that affects one person, you, with a replacement address available the same day.
What Actually Gets Built
One small server, running as little as possible, in a country close enough for the latency to be tolerable. Most of the work is in what gets left off the machine and in how it answers strangers, rather than in the software itself.
The Machine
A minimal Debian install on a VPS outside the country, usually in Japan, Korea or Singapore, since the distance to the server is most of what decides whether video calls feel usable. No control panel, no web dashboard, no extra services listening. Every additional thing running is one more detail that makes the machine look unusual.
The Address
Yours alone, not shared with other customers and not published anywhere. This is the part a subscription cannot give you at any price, because their business model requires handing the same addresses to everybody who signs up.
A Real Domain And Certificate
The server sits behind an ordinary domain with a valid certificate and answers on the standard web port. To anything that connects without the right credentials, it behaves like a small website with nothing interesting on it, which is exactly the point.
Two Methods, Not One
We configure a primary transport and a second one that behaves differently, both already installed and both already in your client. Conditions there change with the calendar, and the answer to a bad week is switching profiles rather than waiting for a provider to fix something. Which two depends on what is working when your server is built, and we tell you what we chose and why.
Your Devices
Configuration files and QR codes for a laptop and a phone, running generic client software rather than a branded app. Install the clients before you fly, because the useful ones are not in the app stores once you are inside the country. The config itself is a file you can keep in three places.
A Replacement Ready
If the address stops answering, you get a new one and the same configuration moves across. We write down that procedure at handover so it can be done by whoever is available, and the cost of a fresh address is a few dollars rather than a new subscription and a lost month.
We are not going to promise that any single setup lasts forever. Anything that works well enough for long enough eventually gets attention, and anyone claiming otherwise is selling. What a private server gives you is a smaller target, a failure that affects one person instead of thousands, and the ability to move the same day rather than wait on a company that has millions of other customers to think about first.
What To Expect Once You Are There
A working connection most of the time, a slow one some evenings, and a bad week every so often. That is the honest shape of it, and knowing the shape in advance is most of the difference between a setup you trust and one you keep replacing.
Speed Depends On The Hour More Than The Server
The links that carry traffic out of the country are busiest in the evening, so the same connection that felt fine at eight in the morning can crawl at nine at night. Nothing on your machine has changed. The road between you and it is simply full, and no provider at any price gets around that.
Latency Gets Added, Never Removed
Traffic goes out to Japan or Singapore first, which adds real round trip time to everything. Browsing, email, documents and video calls take it well. Anything that reacts to every keystroke, like a remote desktop session or a game, will feel the distance the whole time you are connected.
Some Weeks Are Worse Than Others
Filtering tightens around certain dates and events, and a setup that has been reliable for months can turn unreliable for a stretch and then recover on its own. This is the week the second method earns its place, and it is also the week to avoid concluding that the whole thing is broken.
Install Everything Before You Fly
Clients on the laptop and the phone, configuration files saved in your email, on the devices and on a USB stick. Getting software once you are inside the country is the hardest part of fixing anything, and it is entirely avoidable with twenty minutes of preparation at home.
Keep One Route That Does Not Depend On Your Server
An international roaming SIM from your home network carries traffic back through your own operator, which is a genuinely separate path. It is expensive per gigabyte and it is not a daily solution, though it is worth having for the first hour after you land and for the evening when something needs fixing.
One Person, Or A Household
A single small server handles a family or a couple of colleagues comfortably. Once a whole office depends on it, the amount of traffic leaving one address starts to look like what it is, and the sensible answer becomes more than one server rather than a bigger one.
What It Costs To Run
- VPS in the region $5 to $15 / mo
- Domain name about $10 / yr
- Replacement address if one dies a few dollars
- Build, configuration and handover [your fee] once
The hosting and the domain are billed to you directly by the providers, in your name, so the server stays yours whether you speak to us again or not. Prices vary by host and region, and the cheapest option is rarely the right one here, since the route your traffic takes matters more than the specification of the machine.
Tell Us Where You Are Going And When You Fly
Those two answers decide the region and the timeline. We build the server, configure two methods rather than one, send you the files, and test the whole thing with you while you are still somewhere it is easy to fix. The preparation is the part that matters, and it has to happen before you land.
Request your setup