WireGuard Handshake Succeeds but No Internet? Why We Insist on CN2 GIA, With DMIT Deployment & Out-of-Stock Alternatives

Preface
Recently, several friends asked me about a strange issue: the WireGuard client shows that the “last handshake time” is perfectly normal, indicating that the VPN connection has been successfully established, but no websites will open, whether domestic or foreign. What is going on?
I ran into the exact same problem myself. After troubleshooting for ages, I confirmed the AllowedIPs configuration was fine, the firewall rules were correct, and the server status was normal. The handshake packets went through without issue, but the moment I tried opening a webpage, it would just hang and fail to load.
I eventually figured out the root cause: the ability of small packets and large packets to pass through the network is completely different. WireGuard handshake packets are only a few dozen bytes—tiny control packets. Even if the network is congested to the point of nearly dropping, these small packets can still squeeze through, so the client shows a successful handshake. However, opening a webpage requires transmitting business data packets ranging from several hundred KB to a few MB. At that point, the congested network simply cannot move these large packets, and everything freezes into a blank page.
So why is there congestion? Simply put, the VPS route you are using is too poor. On ordinary international routes, during the domestic evening peak hours (20:00-23:00), users all over China squeeze through the same international exit, turning it into a parking lot. Forget about watching videos during this time—even loading the Google homepage takes forever.
I previously considered adjusting AllowedIPs to fix the issue of domestic traffic routing through the VPN: excluding domestic IP ranges so domestic traffic connects directly while foreign traffic goes through the VPN. But after trying it, I realized this problem cannot be perfectly solved. Domestic and foreign IP ranges are too numerous and messy, with many overlaps. You can never finish excluding them all, and eventually, you end up accidentally blocking common domestic services, which does more harm than good.
Therefore, to solve this problem at its root, there is only one way: find a premium route that is stable enough to avoid congestion even during evening peak hours—namely, the China Telecom CN2 GIA route we often talk about. Only by using this kind of route can you guarantee that your VPN connection will run smoothly at any time, without ever encountering the bizarre issue of a successful handshake but inaccessible websites.

1. First, understand this: what are the differences between the three mainstream VPS routes? Why must we have CN2 GIA?
When buying a VPS, many beginners get confused by terms like “BGP”, “CN2 GIA”, and “CMIN2” in provider marketing, not knowing which to choose. In reality, these three routes are like the difference between an ordinary national highway, a provincial road, and a VIP expressway—the experience is worlds apart.

1. Ordinary International BGP: The most basic “national highway”
   The ordinary international BGP route is the most basic internet routing, without any specific optimization for domestic ISPs. All user traffic squeezes through the same international exit.
   Latency performance: Latency from China to Los Angeles, USA, is typically around 180-220ms.
   Evening peak performance: After 20:00, congestion is severe, with packet loss rates reaching 5%-20%. Opening a webpage often takes dozens of seconds, or even times out directly.
   Suitable scenarios: Only suitable for temporary transitions or scenarios with extremely low network requirements. The daily experience is very poor.
   This is why, for providers like Vultr, even though the price is cheap, I only use them as a backup transition option. Their route is this ordinary BGP, which is barely usable and cannot be relied upon long-term.
2. CMIN2: The “provincial road” for mobile users
   CMIN2 is China Mobile’s international optimized route, specifically optimized for mobile users’ return traffic to China, equivalent to an exclusive semi-VIP lane for mobile users.
   Latency performance: For mobile users, latency can drop to 70-90ms, much better than ordinary BGP. However, for telecom users, it still uses ordinary optimized routing, with latency around 60-80ms, which is not as good as CN2 GIA.
   Evening peak performance: Much better than ordinary BGP, but there is still slight congestion, with a packet loss rate of about 1%-3%. Daily browsing is fine, but heavy downloads or HD video streaming will still experience some lag.
   Suitable scenarios: Suitable for mobile users, or users with limited budgets and less stringent stability requirements. The cost-effectiveness is good, but it is not as stable as CN2 GIA.
   The low-cost optimized plans from providers like Racknerd and CloudCone that we mentioned earlier actually use this CMIN2 or CN2 GT (half-path CN2 optimization) route. Their prices perfectly match our $20 budget, but their telecom routes are not true CN2 GIA, and their stability during evening peak hours is still a bit lacking.
3. CN2 GIA: The “VIP expressway” for telecom users
   CN2 GIA is China Telecom’s high-end, fully optimized route. It is the best civilian international route available today, bar none. It is like having a dedicated VIP expressway opened just for you. Starting from your domestic provincial node, it travels the entire way through Telecom’s CN2 high-speed backbone network, with no ordinary congested nodes along the way.
   Latency performance: Latency from China to Los Angeles, USA, can stably stay at 30-60ms, and coastal areas can even reach under 20ms, similar to the latency of accessing domestic websites.
   Evening peak performance: Because CN2 GIA has dedicated QoS priority, even if the entire network is congested during evening peak hours, Telecom will prioritize GIA user traffic. The evening peak packet loss rate is kept below 0.5%, which is virtually unnoticeable. Whether you are watching 4K videos, gaming, or downloading large files, there is absolutely no lag.
   How to identify real vs. fake CN2 GIA: It’s simple. Run a traceroute. If all core nodes start with 59.43, it is real CN2 GIA. If nodes starting with 202.97 appear, it is fake—either CN2 GT or an ordinary route.
   This is why we insist on finding a CN2 GIA route—only it can guarantee that your VPN will run smoothly at all times, without the “handshake successful but websites won’t open” issue.
   Why, within a $20 budget, are only DMIT and ZgoCloud true CN2 GIA?
   Many providers advertise CN2 routes, but most are fake—either half-path CN2 GT, or CMIN2 repackaged as CN2 to fool people. Moreover, true CN2 GIA is very expensive, and most providers’ CN2 GIA plans are priced far beyond our $20 budget.
   After filtering, only two providers offer true CN2 GIA routes within this budget:
   DMIT: Its Premium network is a self-operated CN2 GIA route. The official site explicitly states it includes China Telecom’s next-generation bearer network CN2 GIA, and it uses self-operated bandwidth rather than resale, so route quality is highly guaranteed. The previous $12.98/month LAX.AN5.Pro.TINY plan used this route, but unfortunately, it is now out of stock (Note: I waited about 2 weeks and it was not restocked).
   ZgoCloud: Its newly launched Los Angeles tri-network optimized plan routes Telecom via CN2 GIA, Unicom via 9929 (Unicom’s high-end optimization), and Mobile via CMIN2. Users of all three ISPs get to use their respective high-end routes. Plus, its entry-level annual plan is only $58, which breaks down to just $5 per month—far below our budget—for a true CN2 GIA route, offering maximum cost-effectiveness (Note: Low-price plans are also frequently out of stock. I have Chengdu Mobile broadband at home, so I ultimately opted for a higher-priced plan and waited a few days).
   Others like Racknerd and CloudCone, while fitting the budget, use CMIN2 or CN2 GT routes, not true full-path CN2 GIA. Their evening peak stability is still a bit lacking, so they can only serve as alternatives.

2. Register an account (direct access from China, no VPN required)

1. Open the DMIT registration page directly: https://www.dmit.io/register.php (Accessible directly from China without a VPN; even if my VPN is down, I can still reach it) (See Figure 2)

1. Enter my email, set a password, complete the slider CAPTCHA, and click the “Register” button (No phone number required, just as simple as registering on Vultr)
2. After registration, the system automatically logs into my account. There is no need to manually enter the username and password to log in again; you only need to complete email verification afterward (the verification email will be sent to my registered email to ensure normal account use) (See Figure 3).

3. Deploy the basic server (create a valid order first, resolve the top-up prompt issue + explain the status of all nodes + detail alternative providers)
Important note: DMIT requires an “active order” (a deployed server) before you can add funds (otherwise it prompts: “You must have at least one active order before you can add funds”). Therefore, you must deploy the server first, then top up. This is a slight adjustment from my previous Vultr workflow, but the operations are identical.
Status of all nodes: Currently, DMIT’s core nodes are either out of stock or highly priced, which perfectly matches my observations. The details are as follows:

1. Los Angeles node: All instances under Premium, Eyeball, and Tier 1 network types are out of stock, including the LAX.AN5.Pro.TINY (Premium network, $12.98/month) that I could barely accept. The AN5 series for this node is completely sold out (See Figure 6);

1. Tokyo node: All network types and all instances are completely out of stock with no deployable inventory. Consistent with the restock pattern of the Los Angeles node, a large release of inventory is unlikely in the short term (See Figure 4);

1. Hong Kong node: Only some instances on the Eyeball network are in stock, priced at $29.90/month. The cheapest Premium network plan ($39.90/month) is also out of stock. Even if they were in stock, the prices for both network types far exceed my acceptable $12.98/month budget. The cost-effectiveness is insufficient, so choosing this is not recommended (See Figure 5).
   Additional note: The core reason for the DMIT Los Angeles low-price plan shortage is the continuous global rise in hardware costs; the provider has paused sales of the Los Angeles AN5 series. At the same time, the provider plans to expand and upgrade the AS3 (LTS) platform. In the future, this platform will serve as the core high-cost-effectiveness product line and is expected to maintain low prices similar to the $12.98 level, but it is not online yet, and the specific launch date is to be determined.
   Based on industry conditions and DMIT’s official announcements, the Los Angeles low-price Premium plan ($12.98/month) is highly unlikely to be restocked in the short term (within 1-2 months). Only occasionally will a small amount of idle inventory be released from user cancellations, and even when restocked, it will be snatched up within minutes. The Hong Kong Eyeball plan is priced too high, far exceeding my budget, so forcing this choice is not recommended. Prioritize the following high-cost-effectiveness alternative providers (all support one-click WireGuard deployment and Alipay/WeChat Pay, with an operational flow basically identical to DMIT and Vultr).

4. Solutions fitting my budget (sorted by priority, focusing on optimized alternative providers, meeting the $12.98 budget expectation):

1. Option 1 (Highly recommended, fits my budget): Precisely monitor Los Angeles low-price inventory + set arrival notifications to snatch up the scarce restocked inventory. You can open the DMIT inventory monitoring page (https://stock.qixi.me/), which syncs the inventory status of all DMIT network types and instances in real time, eliminating the need to manually refresh the official site (See Figure 7). You can also follow updates on DMIT’s AS3 (LTS) platform expansion; once launched, it is expected to maintain low prices, so keep an eye on official announcements.

1. Option 2 (Highly recommended, alternative to the high-priced Hong Kong node, top choice): Choose a similar high-cost-effectiveness alternative provider (adapts to my operational habits, supports one-click WireGuard deployment, Alipay/WeChat Pay, fits the $12.98 budget, and avoids accepting the $29.90 Hong Kong high price). Below are 3 mainstream, stable providers, sorted by cost-effectiveness. All meet daily usage needs, and their operational flow is basically identical to DMIT, so you can directly refer to the subsequent steps in this guide:

Additional note: The official websites of the following 4 alternative providers are all accessible without a VPN. The operational workflows for registering, deploying a server, topping up, and deploying WireGuard are exactly the same as DMIT’s in this guide. Only the official interface and plan names differ slightly. You can directly refer to the subsequent steps without needing to learn a new process.

2.1 ZgoCloud (zgovps): Currently has Los Angeles tri-network optimized VPS restocks with extremely high cost-effectiveness, fitting my budget expectations. Core advantages: The data center is in Los Angeles, USA, equipped with China premium optimized networks (CN2 GIA + 9929 + CMIN2 tri-network optimization). Latency is 30-60ms, basically identical to the DMIT Los Angeles Premium network experience. It is highly stable, with no detours or packet loss during evening peak hours. It supports one-click WireGuard deployment (with TLS anti-blocking), requiring no SSH login or scripts. It supports Alipay/WeChat Pay, and the official site is directly accessible from China without a VPN. Recommended plan: The entry-level annual plan is only $58 (about $5/month), configured with 1 core (AMD EPYC) / 1 GB RAM / 10G NVMe. This is completely sufficient for daily browsing of foreign websites and Google search/translation. If you need higher specs, you can choose the advanced plan at $12-15/month, which upgrades to 1 core, 2 GB RAM, and 1 TB monthly traffic. This perfectly fits my budget and is less than half the price of the $29.90 Hong Kong plan.
2.2 Racknerd: A mainstream, high-cost-effectiveness provider with a positioning similar to DMIT and guaranteed stability. Core advantages: The Los Angeles node has cheap optimized route plans (similar to the DMIT Premium experience), with occasional restocks at a monthly price of $12-15, fitting my budget. It supports one-click WireGuard deployment and Alipay, and the official site is directly accessible from China. The route uses CMIN2 optimization with a latency of 60-80ms, and evening peak stability is good, far better than my previous Vultr Singapore node experience. The currently available entry-level plan (1 core, 2 GB RAM, 1 TB monthly traffic) is $12.99/month, basically matching the DMIT $12.98 price I could barely accept, without exceeding the budget.
2.3 CloudCone: A niche but stable provider focusing on high-cost-effectiveness optimized routes, suitable for temporary transitions or long-term use. Core advantages: Los Angeles optimized route plans (similar to the DMIT Eyeball experience), with a monthly price of $13-16, and occasional promotions dropping it as low as $12/month. It supports one-click WireGuard deployment (with anti-blocking configuration) and Alipay/WeChat Pay, with an operational flow identical to DMIT. The route latency is 70-90ms, fully satisfying daily browsing and office work without noticeable lag. The price is far lower than the $29.90 Hong Kong plan, so you don’t have to force yourself to accept high prices.
2.4 Backup transition option: ColoCrossing (CC): If the above 3 providers are temporarily out of stock, you can choose this provider as a temporary transition. It is currently in stock with stable pricing. Core advantages: Conventional plans on the Los Angeles node, around $13/month, fitting my budget. It supports Alipay, and the official site is directly accessible from China. The route is an ordinary international BGP line with a latency of 180-220ms. Although not as fast as an optimized route, it satisfies daily browsing of foreign websites. It supports one-click WireGuard deployment, is simple to operate, and prevents usage disruptions while waiting for restocks.

3. Option 3 (Not recommended, for reference only): If you urgently need to use it in the short term and can temporarily accept going significantly over budget, you can consider the in-stock DMIT Hong Kong Eyeball network instances ($29.90/month). This node features tri-network optimization with a latency of 30-70ms (Telecom 30-60ms, Unicom 20-40ms, Mobile 40-70ms). Stability is good, with basically no lag during evening peak hours. It supports one-click WireGuard deployment with TLS anti-blocking, fully meeting daily usage needs. However, the price far exceeds my budget, and the cost-effectiveness is much lower than the Option 2 alternative providers. It is recommended to choose this temporarily only when all alternative providers are out of stock.

系列导航