Using TYO Reach in mainland China

Reach is built to keep working behind the Great Firewall: its connection modes switch automatically to transports that pass filtering, and the Hong Kong, Taiwan and Singapore gateways are direct-IP nodes chosen for exactly this. Install and sign in before you arrive, and the rest mostly takes care of itself.

Before you go

  1. Install Reach and sign in at home. The download page, app stores and sign-in service may be slow or unreachable from inside China. Per-platform steps are in the installation guide.
  2. Open it once and route a browser so the client has fetched your gateway list and policy.
  3. Turn on MFA on your TYO ID if you haven't — and keep your authenticator or the Reach mobile app with you for push approval. See SSO & MFA.
  4. If your company manages Reach, make sure you're already a member of the group; joining later needs the invite email, which may itself be hard to reach.

Once you're there

  • Pick Hong Kong or Taiwan from the tray's Gateway menu (or leave auto-select on Android; the recommended gateway is marked on iOS). Singapore also works well. See Gateway regions.
  • Leave Connection mode on Auto. In China the client leads with Disguise — a transport that looks like ordinary HTTPS — and falls back through the other modes if a network blocks it. If pages stall, switch to Disguise or Slow manually. See Connection modes.
  • Turn on Route mainland China direct (Android: Rules → China mode) so WeChat, Alipay, Taobao and other local services stay on your local connection at full speed while everything else uses the gateway. See Route mainland China direct.
  • Route only what you need. A browser routed through Reach can use Google, Gmail, WhatsApp Web, Slack, Microsoft 365 and your office systems; leave your other apps direct so local services behave normally.

What to expect

  • Sites you route see a Hong Kong, Taiwan or Singapore IP — not a Chinese one and not an Australian one.
  • Speed depends on the local network far more than on Reach; hotel Wi-Fi and some mobile carriers throttle everything foreign. Disguise mode helps; nothing makes a bad link fast.
  • Networks change without notice. Auto mode retries other transports and the client fails over to another gateway if one becomes unreachable, but no tool can promise every network, every day.

Honest limits

  • Only routed traffic is affected. Apps you haven't routed use the local connection and are subject to local filtering.
  • Reach is not an anonymity tool. The gateway hides your IP from the sites you route, nothing more; the local network can see that you're connected to a gateway.
  • Follow local law. You're responsible for how you use Reach where you are.

For teams with staff in China

Team plans add a static egress IP, group policy that can pre-set the region and the direct rules, and identity-based access to office machines and cloud servers without opening firewall ports. The China & India office-access case study shows the setup a Brisbane firm uses.

Common questions

Will Reach get me through hotel Wi-Fi with a captive portal?

Complete the portal sign-in first (with Reach off or a direct browser), then switch Reach on.

Do I need a Chinese phone number or ID?

No. Reach works with your existing TYO ID; nothing is registered locally.

Is there an Australian exit so I can reach Australian-only services?

No — all Reach gateways are outside Australia. Most Australian banks and services work fine from a Hong Kong or Singapore IP; ones that geo-lock to Australia won't.