VPS for China: offshore vs mainland

The short answer

Choosing a VPS for China starts with one question: does the machine sit inside mainland China or outside it? A VPS is a virtual private server, a virtualised slice of a physical machine with root access and its own IP address, billed monthly. That definition holds in every country. What changes in this market is the paperwork attached to the location. A server physically inside mainland China needs an ICP filing before it may serve a public website. A server in Hong Kong, Singapore, Tokyo or Los Angeles needs no filing, and pays for that with a longer and less predictable path to users inside the mainland.

Your audience decides the answer. If your users are outside mainland China, host offshore and you can skip the filing question entirely. If your users are inside it, you are choosing between doing the filing and accepting the cross-border path. If you want the general definition before the regional detail, what a VPS is and how it differs from shared hosting covers it, and the kinds of workloads people actually run on one is a useful companion.

Does a VPS in mainland China need an ICP filing?

Yes, if it serves a public website or app. The requirement is triggered by where the server is, not by where your company is registered and not by who visits it. As of September 2026 the rule is administered by the Ministry of Industry and Information Technology (MIIT), and applications are handled through the provincial communications administration covering the host. ICP stands for internet content provider. The filing itself is written 备案 and transliterated as "beian", and you will meet both forms in provider documentation.

Two different permissions share the name ICP, and mixing them up wastes weeks. The filing is a registration record, and it covers a site that publishes information without selling anything directly. The commercial ICP licence is a separate and much harder permission, needed when the site takes money for goods or subscriptions. The licence is issued to mainland companies and foreign ownership is restricted, which is why a foreign brand normally operates through a local entity. Get legal advice on which one your site needs before you rent any hardware.

Enforcement runs through the host. A provider licensed to sell hosting inside the mainland holds an IDC licence (internet data centre) and is required to check your filing before your domain serves traffic. If the record lapses, or stops matching what the site does, the provider takes the site offline. There is no grace period you can rely on, because the legal exposure is theirs.

What the filing asks for, in outline

• A domestic entity or person: a mainland business licence, or a mainland ID for a personal site. A company registered elsewhere generally cannot file under its own name. The usual routes are a mainland subsidiary, a registered representative office, or a licensed local partner who sponsors the filing.
• A domain registered through a registrar MIIT recognises, with real-name verification completed, and the registrant name matching the filing entity exactly. A domain parked at an international registrar usually has to move first.
• A hosting account with a licensed mainland provider. The provider reviews your documents and submits the application on your behalf. You cannot file for a server that is not theirs.
• A declaration of what the site is for. The record has to keep matching what the site actually does after launch.
• The filing number displayed in the footer of the live site, linked to the government portal, followed by the separate public security filing.

Every published estimate of how long this takes disagrees with the next one. Hosts and filing agents quote anything from a couple of weeks to a couple of months, because the answer depends on the province and on how many times the record comes back for correction. Treat any number you read, including one from a salesperson, as an estimate rather than a schedule. Ask the host you intend to use what they are seeing this quarter, and leave room in the launch plan for it to slip.

One consequence is worth knowing before you sign anything. The filing is bound to that host and to the addresses they issued you. Moving to a different mainland provider means the new provider files again, and address changes have to be reflected in the record. A migration that would be an afternoon of work anywhere else becomes an administrative project, which is the sharpest version of the problem covered in what really locks you into a hosting provider.

Which regions avoid the filing?

Anything not physically in the mainland. Hong Kong, Macau and Taiwan are separate jurisdictions for this purpose, as are Singapore, Japan, South Korea and the United States. You cannot obtain a mainland filing for a server hosted in those places, and you do not need one. That is why "no ICP needed" appears in every Hong Kong hosting advert. The claim is accurate, and it holds equally for every host outside the mainland.

Content delivery catches people out. Putting a CDN (content delivery network) in front of an offshore origin server does not remove the requirement if that CDN serves your files from points of presence inside the mainland. The bytes reach the reader from mainland infrastructure, so the rule applies to that delivery. A CDN that covers Chinese users from Hong Kong or Japan does not need a filing. The two products look identical in a feature list, so read the fine print on the network map.

Why offshore hosting feels slow, and what actually varies

Distance sets a floor. Light in fibre travels roughly 200 km per millisecond, real routes are longer than the straight line, and a round trip from Shanghai to Los Angeles cannot be short. Distance is rarely the thing people are complaining about, though. Two other factors move the number much more.

The first is the border crossing. International traffic in and out of the mainland is concentrated through a small number of gateway points run by the large carriers. Capacity there is shared and finite. When the domestic evening peak arrives those links fill up, so a path that measured well at 10:00 local time shows packet loss and jitter at 21:00. That is congestion on a link you do not own, and no setting on your server changes it.

The second is the transit your provider buys. Every network on the internet has an ASN (autonomous system number), and a packet crosses a chain of them to reach a user. For the mainland the names you will meet are China Telecom's older ChinaNet backbone (AS4134), China Telecom's premium CN2 network (AS4809), China Unicom (AS4837) and China Mobile. Hosts advertise labels such as "CN2 GIA" or "China direct" to say which of these their upstream pays for. Premium transit costs the host more, so a Hong Kong VPS on a direct route sells for several times the price of a generic one in the same building. The label tells you what was purchased. It does not tell you how oversubscribed that circuit is on the evening you launch.

Return paths are the detail most people miss. Routing is asymmetric. Your provider's network chooses the path packets take out of the server, and the user's carrier chooses the path back. A clean traceroute from your VPS toward an address in Guangzhou proves very little, because you measured one direction and the user feels both.

Cross-border traffic also passes through national filtering. Whether a given service or domain is reachable from inside the mainland is not under your hosting provider's control and is not something you configure on the server. Treat reachability as a property of the market you are entering, and let it inform where you host.

Test from where your users are, not from your laptop

Every performance claim in a provider's marketing describes their network on a good day. The only measurement that counts is taken from your users' networks, on their ISP, at the hour they are online. Rent the candidate server for a month and measure it yourself. Monthly billing is cheap enough that testing two regions side by side costs almost nothing against the price of choosing wrong, and what a VPS actually costs per month puts those numbers in context.

From a machine on the network you care about, run a path report toward the candidate server:

mtr -rwzc 100 vps.example.com

-r prints a report instead of the live display, -w keeps hostnames from being truncated, -z shows the ASN of each hop, and -c 100 sends a hundred probes so the loss column means something. Read the final line first. Loss on a middle hop with a clean final hop is normal, because routers give low priority to ICMP replies addressed to themselves. Loss that starts at one hop and continues to the end is real.

Then measure what a browser would feel:

curl -o /dev/null -s -w 'dns %{time_namelookup} connect %{time_connect} tls %{time_appconnect} ttfb %{time_starttransfer} total %{time_total}\n' https://vps.example.com/

connect minus dns is one round trip, so that difference is your real RTT (round trip time) including the return path. tls minus connect covers the handshake, which costs further round trips. That is why a high-latency link punishes every new connection, and why fewer, longer-lived connections help more than any kernel tuning. If ttfb sits far above tls, the delay is your application rather than the route.

Run both at the local evening peak, and repeat on several days. A single midday sample from a quiet office network is the most flattering figure you will ever collect, and it is the one that makes every provider look good. If you cannot get a machine inside the market, ask a real user there to run the same two commands and send you the output.

So which one do you pick?

If your audience is mainly outside mainland China, host offshore near those users and treat mainland access as best effort. A filing buys you nothing when the people it serves are on the other side of the border.

If your audience is inside the mainland and the site carries real revenue, do the filing and host inside. Domestic routing avoids the congested gateways completely, and a filed site is one your host will not switch off.

Plenty of companies end up with both: a filed mainland presence for the public site, and offshore servers for everything else. Choosing between two nearby offshore regions is the same exercise as choosing between neighbouring markets anywhere. Measure, then decide. the same comparison applied to Canada and the United States works through the version where the legal difference is small and routing settles it.

FAQ

Do I need an ICP filing for a VPS outside mainland China?

No. The requirement follows the physical location of the server. A VPS in Hong Kong, Singapore, Japan or the United States can serve visitors in the mainland without a filing, and cannot obtain one. The exception to watch is content delivery: if your files are served from points of presence inside the mainland, the rule applies to that delivery no matter where the origin server sits.

Can a foreign company get an ICP filing on its own?

Usually not under the foreign entity's own name. The filing wants a mainland business licence, or a mainland personal ID for a personal site. Foreign companies normally file through a mainland entity such as a subsidiary or a registered representative office, or through a licensed local partner who sponsors the application. A site that sells directly also needs the commercial ICP licence, which is issued to mainland companies with restrictions on foreign ownership. Confirm the current position with a lawyer before you commit to a launch date.

How long does an ICP filing take?

Published estimates run from about two weeks to a couple of months, and they disagree with each other because the answer depends on your province and on how many rounds of correction your record needs. Ask the licensed host you plan to use what they are seeing right now, and treat the reply as an estimate. Do not book an announcement against it.

Why is my Hong Kong VPS fast in the morning and slow at night?

Because the cross-border links are shared, and they fill during the domestic evening peak. Latency and packet loss rise on the congested gateway rather than on your server. Confirm it by running mtr -rwzc 100 from inside the market at both hours and comparing the loss and jitter columns for the hops after the border. If your server's own CPU and disk are idle in both samples, the path is the cause.

Does paying for a premium route such as CN2 guarantee good performance?

No. A premium transit product covers one carrier's network in one direction of the path. The return path is chosen by your user's carrier, and the label says nothing about how oversubscribed your host's slice of that transit is. Premium routing is worth paying for when your own measurements show it helps. Measure first, from the market, at peak.