What is the risk of my VPN traffic routing through China?

Question

I recently set up a new VPN on a Hetzner VPS (using Wireguard). It works fine, but I notice that when I do a traceroute from home to the server, I see several Chinese intermediaries.

I'm not too thrilled with any of my traffic touching Chinese servers, but I'm wondering, assuming my VPN server has a basic but functional configuration, what risk am I actually running with my traffic going through these Chinese servers?

Is it possible/likely/probable/etc that my traffic can be decrypted en route? Are there any even minor security risks (specifically in regards to the Chinese routing) that I should keep in mind?

Answer 1

In the case of VPNs, you shouldn't have to worry about whether or not it goes through China. What you should worry more about is the integrity and model of the VPN service you're using. If the encryption is secured, it should not matter what route your traffic takes.

Here's a simple model of a VPN (MITM = man in the middle)

You ----- VPN
      ^
     MITM

If the VPN service is secured, no one as the MITM should be able to read your data, Chinese or not. It should be the same no matter what route your traffic takes: everything between you and the VPN server is encrypted.

Even if the host/server of your VPN is in China, the main concern should be "Can I trust this VPN provider?" rather than "Can I trust China?". If the government mandates the VPN provider to give them your data, that's going to depend on the provider to not give out your data.

TL;DR: It shouldn't matter what's between you and the VPN. It should be encrypted and no one should be able to read it.

Answer 2

Older VPN protocols are weak. Their encryption can be broken by state sponsored organizations. Try latest L2TP IKEv2 techniques to stay safe.

You should also consider the fact that many standard protocols are censored at the great firewall of China. That means the VPN protocol itself may need to be cloaked inside ordinary traffic, which calls for the use of things like SSTP or some non standard protocol, e.g. HTTP Tunnel, DNS Tunnel, ICMP Tunnel, etc. plus proper encryption.

That way you can be 99% sure of your privacy.