Astrill VPN
 

My ExpressVPN subscription ended a few days ago and I thought I would give Astrill a try based on the recommendation of a fellow FTer. So far, my experience have been a bit frustrating. It's probably user error in my part so I thought I would create this thread. I only paid for a one month subscription. If things don't improve by the end of this month, I'm leaving Astrill and may just sign up when I need to use it in China.

So far I have only tested Astrill on two Android devices: Samsung Galaxy S8 and Google Pixel 2 XL. For reasons that I don't understand, my phone's connection to Astrill would break. Unfortunately, it doesn't seem to pause my connection for security reason unlike ExpressVPN. This is a concern as this happened when I was at a Marriott hotel. It's important that my connection is secured at all times. That's what I loved about ExpressVPN. My connection would pause if I get disconnected. So what's the problem with Astrill and how can I configure it to behave more like ExpressVPN?

There seems to be 3 protocols. What are the differences and which one is the best to use?

Astrill flat out doesn’t support the kill switch on any mobile platforms, only desktop.

Several of Astrill’s protocols are proprietary, which makes it difficult to find third party critiques to reliably answer questions on which protocol(s) are superior.

Oh boy! Sounds like I'll be back on Express VPN very soon then!

​​​​​​Which one? I see three when I open the app.

​​​​​​

OpenWeb and StealthVPN

Which protocol do you normally use?

I don’t use Astrill anymore, but generally OpenVPN. My needs also doesn’t include trying to defeat the Great Firewall.

I definitely made a mistake with Astrill VPN. I've encountered several other issues that I didn't experienced with ExpressVPN. I'll be going back to ExpressVPN in May and I'll just use Astrill whenever I'm in China.

Out of curiosity, what is your use case while in China? TGFWC is annoying in that it's inconsistent (at least in the past). I've need Nord and PIA work, but sometimes it takes a half hour or more just for it to lock on and connect.

Access blocked North American websites.

Anyways, I can't recommend Astrill VPN at all. I'm also experiencing connection problems where I lose internet access even though Astrill says I'm connected. I can disconnect and reconnect, but it's annoying having to do that every few hours. It happens to me no matter which protocol and server I use. ExpressVPN just work!

Thanks. The reason I ask is that most popular VPNs have that connectivity issue (as I said, TGFWC is not consistent but it eventually does cut the connection off). ExpressVPN is one of them. There is a list of VPNs floating around somwhere which are authorized by the CCP but how private they truly are is definitely in doubt.

One option that some people have successfully used is hosting their own VPNs (eg, using a cloud provider or through their own internet connection and a virtual machine... this is usually from their corporate office or data center).

Depending on your use case, another possibility is using something like teamviewer/anydesk/vnc (make sure you use MFA for security purposes) to an endpoint outside of China (I've done this).

There are a few other possibilities depending on how technical you are and how much effort. If ExpressVPN works for you, great, I just have seen them and others who aren't registered with the Chinese government being cut off randomly.

I would not use any VPN that is endorsed by the Chinese government.

I never said ExpressVPN worked in China. I never tested it. Seems like the consensus is that its not reliable within China. China aside, I still want to use a VPN over an unsecured connection like the hotel's wifi. ExpressVPN isn't perfect, but no major issues unlike what I'm going through with Astrill at the moment.

All the VPN big boys will have issues in China. That said, there may be a solution you may be able to use in conjunction with a VPN... In the past, HK-based SIM cards were not subject to filtering via the firewall. Depending on your bandwidth and transfer requirements, you might be able to hang off an HK based cell number. This might no longer be true since the security law passed, but passed, but something to look into.

One other thing... From personal experience (but several years ago)... If you hook up your own laptop to a Chinese hotel's internet, use your own router instead of the hotel's wifi. If I hooked up directly my firewall would light up like a Christmas tree with alerts. Probes, redirects, all sorts of assaults on my laptop. If I used my own router, a lot of the alerts stopped. It has gotten to a point where some large corporations issue you a "burner" laptop if you have to travel to China. When you return, the burner is re-imaged and definitely not allowed to connect to the corporate network before.

Yes, I've tried that before, but it's not cost effective if I want to do something as simple as watching Netflix.

I wonder if Express is working on making their VPN more reliable in China?

Which router do you recommend? I'm not aware of any small portable router that works with Express.

ExpressVPN likely switches up their server addresses to avoid the GFWC. The only way to get a "reliable" VPN service in China is to get licensed which would mean handing over any encryption keys they may use there. You can often connect, but it doesn't always work, might take a lot of time or be subject to random disconnects as the packet inspection decides you're not authorized. In the past, I've seen a number of western vloggers, they usually hop across the bay to upload their material (still using a VPN). Those that do not usually go to licensed VPN providers. Again, a lot of this may have changed since the crackdown as they really don't want unrestricted news feeds to become prevalent in China ("for harmony purposes")

As I mentioned before, you could also attempt to use a corporate VPN if you have one (although that has it's own issues). You could set one up yourself if you have a router capable of it.

VPN software and a router are two different things. VPN software is hosted on your computer and initiates the connection to the target entry and exit points. A router is just an additional segment in that connection. I brought just a regular router when I traveled there (I still do if I'm traveling and know I can't secure a decent wifi signal), but those aren't the portable type. They gave me a stronger signal which the portable ones usually didn't. I could also set up my own internal network before I left the country if I needed one.

I can't speak for the current generation of portable routers, but any Wifi AC router should be more than enough for the standard hotel room (assuming you have wired ethernet... in the bigger cities, they may have switched completely to wireless).

A Raspberry PI with Pi-VPN makes a great personal VPN if your router doesn't have one built in. Should cost < $30.

Very true. Haven't tried it myself. But definitely worth it.

Never heard of Astrill, but I've never had issues with PIA (Private Internet Access) using OpenVPN or (now) Wireguard on iOS, macOS, and Windows 10. I also run a VPN server at home, in case countries like China have blocked all the IP's of the major VPNs.

It's been almost 3 weeks since I signed up for Astrill and my frustration with the service is through the roof. The service keeps disconnecting after the screen is off for a period of time. I've already added Astrill to a list of services to be exempt from power conservation and this behavior still exist. Sometimes, the app and the VPN icon is on, but nothing works. The only way to restore service is to disconnect and reconnect.

I think you mentioned in a previous post that you signed up for a single month. I'd suggest just looking for another provider at this point based on your frustration. Maybe go back to ExpressVPN as they seem to be the most active in trying to evade the Great Firewall and if you're concerned, maybe get NordVPN or PIA as a backup (although in theory all three could be blocked at the same time).

As mentioned previously, if your router supports it, maybe set up your own VPN. Or if you're proficient in Linux and have a RPI lying around, set one up using that. Or (last one) you could set up a free account on a cloud provider (maybe not one of the big boys, but someone like linode.com which doesn't entirely charge by transfer) and set up a VPN (in theory you could repeat the process every time you go to China as the free accounts usually expire once their credits are all used up).

If it's just bypassing geoblocking, then setting up your own should do the trick. That said, some advice I would provide (take it or leave it)... if your "modem" (DSL or cable or whatever) supports plugging in multiple routers (imagine NAT going wild), then I would have a dedicated router with nothing else connected to it as the VPN host. Segment your network to prevent exposing other endpoints in your home/office to the VPN. That way if it becomes compromised, the other endpoints in your house are somewhat protected (in theory).

How do you know that they're still working on it?

Take a look at some of the Youtube vloggers that vlog out of China (and are critical of them). That'll give you a general idea.