From what I've heard second-hand (my SO has a friend who frequently travels to China), they do actually block people's private one-off VPN servers quite effectively.

Have a look at https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf - it talks about GFW using machine learning with flow analysis to do this.

Indeed they do. It starts off working fine, but then eventually it stops. I assume they're running some AI/ML against the traffic pattern to determine if it's a VPN. I think they're light-years beyond simple traffic blocking and shaping.

I took that class (comp 116) a few years ago! Just had some fun finding and rereading my own final paper from the archives (the one you linked to makes mine seem way less interesting). Ming is a really awesome and unique lecturer.

If I may ask, why pass the perfectly appropriate opportunity to... link it here?

basically, netflow analysis tools feeding into an automated pattern matching system. 100% crypto traffic no matter what looks different than usual usage patterns. The netflow tools need some time to gather enough flow statistics between your outside-china VPN endpoint and your domestic IP, but once that's gathered, it's pretty hard to get around.

tools like obfsproxy for openvpn can help.

Why do they not outright block encrypted connections which they fail to bruteforce?

That blocks a large percentage of the websites out there now.

It's probably easier to just block all AWS/Azure/Linode/DigitalOcean/etc... blocks.

If you are just visiting, the Great Firewall is not really a problem, as foreign SIM cards route directly to the internet. Just make sure you have a reasonable international plan with your carrier before you go.

This is true. My phone connected to 4g when I turned it on but then upon my first search using google now it disconnected and then reconnected to an H+ network and completed the search. It was pretty cool how they made a completely separate network for it.

With the caveat that in some countries the way data roaming works is all the data is routed back to your home before actually being routed to its destination - for example, if I visit Canada with a US T-Mobile SIM, all my traffic first has to travel to the US, even if I'm pinging a Canadian server.

If you end up with this sort of data configuration in China, you'll be having a bad time using it for anything performance-sensitive. Good enough for email though, I bet.