For people who work here

Working remotely from China

Three problems separate people who work comfortably from China from people who fight their laptop every day. None of them is "can I reach Google". That one is easy. These are the ones nobody warns you about.

Acronyms used below

VPN: Virtual private network, an encrypted tunnel to a server elsewhere.
IP: Internet protocol address, the number that identifies your connection to every service you use.
GFW: The Great Firewall, China's national traffic filtering system.
API: Application programming interface, the machine-to-machine endpoints your software calls.
CLI: Command line interface, a program you run in a terminal.
KYC: Know your customer, the identity verification banks and regulated services run on you.

Paperwork

A Hong Kong ISP line, for anything involving your home country

Reaching a website is not the problem. Being trusted by it is.

The dense balcony facade of an older Hong Kong tower block, hundreds of flats with window grilles and drying racks. — CC BY 2.0

Why a datacentre address fails

An ordinary broadband line does not look like a robot

Every IP address carries a reputation, and the type of address is easy to look up. Address blocks are registered to their owner, and a block registered to a hosting company is not where people live and work. When your bank sees a login from an address belonging to a cloud provider in Frankfurt, its fraud engine reads that as automated traffic, or as somebody deliberately obscuring where they are, because that is usually what it is.

Almost every ordinary VPN gives you exactly that: a datacentre address, in a hosting range, shared with many other users at once, and already flagged because somebody on it did something abusive last month.

What that produces, in practice

Home bank login

Extra verification, a device you cannot register, a security question you set nine years ago, or a hard block with a phone number to call during your home country's office hours.

Tax portals and government services

Many national tax and identity portals are geo-restricted, rate limited, or simply behave badly for traffic from flagged ranges. Filing deadlines are not sympathetic.

Payment dashboards

Stripe, PayPal and similar platforms watch administrator logins closely, because account takeover is their main fraud vector. A login from a hosting address in a country unrelated to your business is a textbook takeover signal. Consequences run from a verification challenge to a hold on payouts.

KYC and identity checks

Onboarding flows for banks, brokers and exchanges commonly record the IP alongside your documents. An address that does not match the story your documents tell is a reason for manual review, at best.

Impossible travel

The sharpest one. Your phone checks mail from Shenzhen at nine. Your laptop appears on a Frankfurt hosting address at nine oh two. The system computes the distance and the elapsed time, concludes that no human did that, and locks the account. Now you are running an account recovery from a country where the recovery mailbox may itself be blocked.

What we actually run

Our Hong Kong exit is not a rented server in a datacentre. It is a physical machine on a Hong Kong broadband line, connected through a Hong Kong internet service provider, in Hong Kong. The address it uses is registered to that provider's network, the way any business or home broadband address is, not to a hosting or cloud operator. You can check that yourself: look up the address you are given and see who it belongs to.

That is the whole claim, and it is a narrow one. Risk scoring systems classify addresses by what kind of network they sit on. An ISP broadband address is not scored as a datacentre address, a hosting address, or a known VPN address pool, because it is none of those things. The routine extra checks that a normal VPN triggers do not fire, because nothing about the connection looks unusual.

Hong Kong specifically, for three reasons. It is physically close to the mainland, so latency stays low and your session does not feel remote. It is a plausible place for somebody working in Asia to be, so your connection tells a coherent story instead of teleporting you to another hemisphere. And it is outside the GFW, so what comes out the far end is unfiltered.

How the route works

You do not connect directly to the Hong Kong line. The client connects to our Japan entry point, and the traffic then egresses from the Hong Kong ISP connection. Entry and exit are separate, which is why the entry point can move when it needs to without changing the address the world sees you on.

Korea and France exits are being built on the same pattern. They are not live yet, and we will say so on this page until they are, rather than listing them as though they were.

What it does not do

It does not make you anonymous. Every service you log into still knows exactly who you are, because you told it.
It does not hide that you are connecting remotely. It changes how your connection is classified, not where you physically are, and it does not satisfy a rule that requires you to actually be somewhere. If a service asks where you are, answer honestly.
It is not a way around a service that has genuinely decided to block you. If an account has been restricted, or a platform has excluded your jurisdiction, changing your exit address is not the remedy and treating it as one tends to make the situation worse.

What it does is stop a legitimate, routine login from being misread as an attack.

Agents

A command line client, for running AI agents from here

Coding agents changed what a network outage costs. It used to mean a slow afternoon. Now it means your tooling does not run at all.

The problem, plainly

An AI coding agent such as Claude Code is a program that calls an API over the network, constantly. It also pulls packages, clones repositories, reads documentation and hits other services on your behalf. In China, a good share of those endpoints are unreachable or unstable.

What makes this expensive is how they fail. A blocked API does not usually return a clear message. The connection hangs and times out. The agent retries. A partial response arrives and gets parsed as a real answer. A dependency install stalls at 94 percent and leaves a half-written cache. You get a tool that appears to be working slowly, when it is actually not working at all, and you spend forty minutes debugging your own code before you realise the problem is the route.

Why a graphical app is not sufficient

Headless machines. A build server, a home lab box, a rented instance, a Raspberry Pi doing something useful in the corner. No screen, no one to click a connect button.
Terminal-only sessions. You are on a remote machine over SSH. There is no desktop to open.
Automation. A scheduled job at three in the morning cannot wait for a human to authenticate a dialog box.
Reboots. The machine restarts, the graphical app does not come back, and every job after that fails in the confusing way described above.

What the CLI does

bimvpn is a command line client. It brings the tunnel up, reports status, and manages routing rules, from a shell, on a machine with no display. An agent session gets working network access without a person in the loop.

$ bimvpn connect --node hk
  connected   entry jp-01   egress hong kong isp line
$ bimvpn split add com.docker.docker --direct
  direct      com.docker.docker
$ bimvpn status
  tunnel up   47 ms   split tunnelling on

It also matters that you can change routing without dropping the tunnel. Adding an exclusion mid-session, with the connection held up, means an agent that is halfway through a long task does not lose its network underneath it. Anyone who has watched a two-hour job die at the ninety minute mark will understand why that is a feature and not a detail.

Speed

Split tunnelling, the biggest speed win nobody uses

This is the shortest section and the one that will change your day the most.

The default is wrong

Most VPN clients send every packet through the tunnel. On a normal connection abroad that is merely wasteful. In China it is actively harmful, because a large part of your daily traffic is going to servers a few hundred kilometres away, and you are routing it to Hong Kong or Tokyo and back.

Taobao. JD. Bilibili. Meituan and Ele.me. Your Chinese bank. Amap and Baidu Maps. WeChat, whose servers are here. Domestic package registries and model mirrors, which is how anybody working in software gets large files at a sane speed.

Two things happen when those go through a foreign server. They get slow, because you added a round trip across an international link that is congested at exactly the hours you are awake. And some of them break outright, because a Chinese banking or payment service seeing a foreign IP will refuse the session, ask for verification it cannot complete, or lock the account for suspicious access. Being on a VPN is how people get shut out of their Chinese bank app, not the opposite.

The right shape

Split tunnelling routes by destination. Chinese destinations go direct, over your local connection, at full domestic speed. Blocked foreign destinations go through the tunnel. Both work, at the same time, without you switching anything on and off.

In practice this means the routing table already knows the Chinese address ranges and the Chinese domain list, and sends them direct automatically. You do not maintain that list. Package mirrors and model hosts, the ones that matter when you are downloading gigabytes, are also sent direct, because pulling a large file through a tunnel is the difference between ten minutes and most of a day. You can add your own exclusions per application, by name or by bundle, when something needs to bypass.

What it feels like

Domestic sites load like you are not on a VPN, because for those sites you are not. Your international traffic works. Your Chinese banking app does not lock you out. Your large downloads run at local speed. And you stop doing the thing everybody here does at first, which is toggling the connection off and on all day depending on which website you want next.

That toggling is the tell. If you are doing it, split tunnelling is off, and turning it on is the single largest improvement available to you.

Download and test before you fly See what it costs