Direct Connect in China: A Guide to Dedicated Network Connections for Foreign Companies

Many international companies run part of their systems in Mainland China and part overseas. Moving data between the two over the ordinary internet is often slow and unreliable: connections drop at busy times, requests between a China deployment and an overseas system time out, and speeds change from one day to the next for no obvious reason.

Direct Connect is the category of service designed to solve this. It provides a dedicated, private network path between your infrastructure and a cloud provider’s China regions, or between China and overseas regions through a licensed cross-border circuit, so that traffic no longer competes with the public internet or passes through its filtering and congestion.

This guide explains what Direct Connect does and does not do, which providers offer it in China, what foreign companies need in order to use it, how implementation works in practice, what compliance considerations apply and how AppInChina can help.

What Is Direct Connect?

Direct Connect is a dedicated network connection from your data centre, office or colocation environment to a cloud provider’s network, bypassing the public internet. AWS China describes Amazon Direct Connect as a way to establish dedicated connectivity between AWS China and a customer’s premises within China, to reduce network costs, increase bandwidth throughput, providing a more consistent network experience than internet-based connections.

The same category exists across providers under different names:

Provider	Service Name	Chinese Name	Notes
AWS China	Amazon Direct Connect	专线连接	Available in the Beijing (Sinnet) and Ningxia (NWCD) regions; separate account from AWS Global
Microsoft Azure China	ExpressRoute	高速专线	Operated by 21Vianet; separate from Azure Global
Alibaba Cloud	Express Connect	高速通道	Widest domestic footprint; physical connections via Alibaba access points
Tencent Cloud	Direct Connect	专线接入	Strong integration with WeChat and Tencent ecosystem services
Huawei Cloud	Direct Connect	云专线	Locations across Beijing, Shanghai, Guangzhou, Guiyang, Ulanqab, Qingdao, Wuhu and Hong Kong

• These services create a dedicated private connection between a company’s network and a cloud provider.
• A physical cable is installed at a data centre where both networks are present. Virtual connections are then configured over that cable to direct traffic to specific cloud environments or resources. BGP, a standard routing protocol, automatically exchanges routing information between the company and the cloud provider.
• This allows data to bypass the public internet, providing more predictable bandwidth, latency and reliability. Cloud providers use different product names, but the underlying model is broadly the same.

What Does Direct Connect Not Do?

“Direct Connect” is frequently used in sales conversations to mean “make our website faster in China”. It does not.

Direct Connect carries traffic between infrastructure you control on both ends. It does not affect how a member of the public in Shanghai reaches your website in a browser. That visitor’s request still travels over the Chinese public internet to wherever your site is hosted, still passes through the Great Firewall if the site is overseas, and still fails if the page depends on Google Fonts or reCAPTCHA.

Problem	Right Tool	Does Direct Connect Help?
Public website slow or broken for Chinese visitors	Mainland hosting or China CDN, ICP Filing, replacement of blocked third-party services	No
SaaS front end loads slowly in China	China-hosted or CDN-accelerated front end with ICP Filing	No
China-hosted application needs low-latency access to an overseas database or API	Direct Connect with cross-border circuit	Yes
Overseas analytics platform needs data from a China processing environment	Direct Connect	Yes
Engineers in China need stable access to overseas package registries	Local mirrors and registries	No
Employees in China need general internet access to overseas sites	Corporate VPN or proxy under applicable rules	No
Partner data centre in China needs private adjacency to your China cloud VPC	Direct Connect	Yes

For public-facing access problems, see How to Make Your Website Accessible in China and Why Does My Website Not Work in China?. Direct Connect is the third layer in the SaaS performance stack described in How Can You Speed Up Your SaaS Performance in China?, and it works alongside the public-facing layers rather than replacing them.

When Should a Company Consider Direct Connect?

Direct Connect is worth the investment when private traffic between China and overseas systems is business-critical, and the public internet is not reliable enough to carry it. Typical situations include:

• Hybrid SaaS architecture. The front end and data that must stay in China are hosted on a Mainland cloud, but back-end services, billing or machine learning models remain in an overseas region. Direct Connect gives the China deployment stable access to those services without rebuilding them locally.
• Data replication and pipelines. Databases, object storage or event streams in China need to synchronise with overseas systems on a predictable schedule.
• Administrative and deployment channels. Overseas engineering teams need reliable access to Kubernetes APIs, CI/CD targets and monitoring in a China region.
• Enterprise hybrid connectivity. A company’s own China office or data centre needs private connectivity to its China cloud VPC for ERP, identity or internal applications.
• Regulated workloads. Financial services, healthcare and industrial companies often need private routing and audit trails for data moving between environments.

A useful test is to write down every traffic flow you expect to cross the border or reach the cloud: source and destination network ranges, ports, direction, peak bandwidth and what happens if the link fails. If a flow cannot be described this precisely, it is not ready for Direct Connect. Flows that turn out to be public browser traffic belong on the public China architecture instead.

Can Foreign Companies Use Direct Connect in China?

Yes, but several prerequisites apply that do not exist in other markets.

A Mainland China cloud account. Direct Connect attaches to resources in a China region, and China regions are operated separately from global cloud platforms. AWS China accounts, for example, use distinct credentials, billing and endpoints from AWS Global, and a global account cannot create a China attachment. Opening a China cloud account requires a Chinese business licence or a partner. AppInChina, as an official AWS China and Tencent Cloud partner, opens and manages these accounts under its own Chinese entity for companies without local incorporation. See The Complete Guide to AWS China for account details.

A licensed carrier for the physical circuit. The cloud provider supplies the port at its Direct Connect location and issues a Letter of Authorization (LOA) for the cross-connect. The circuit from your premises to that location, and any cross-border segment, is provided by a licensed Chinese telecommunications carrier. In practice this means China Telecom, China Unicom or China Mobile, or a neutral colocation operator working with them. Huawei Cloud’s location list illustrates this: its Direct Connect points are hosted by neutral operators such as GDS, by Huawei itself, or by one of the three state carriers.

Colocation or on-premises presence. Your network equipment needs to sit somewhere the carrier can deliver the circuit and the cross-connect can be made, either your own facility or a colocation cage at or near the Direct Connect location.

ICP Filing where applicable. Direct Connect itself is not what triggers the ICP Filing requirement. However, if the China-side resources include a public-facing website or service, that service still needs an ICP Filing before public ports are opened, regardless of how the back end is connected.

Where Are Direct Connect Locations in China?

Each provider publishes a list of colocation facilities where connections can be made. Choosing a location close to your existing infrastructure and in the same metro as your target cloud region keeps circuit costs down and latency low.

Huawei Cloud’s published locations give a sense of the geography. Its CN North-Beijing region has points in Beijing and Langfang; CN East-Shanghai has points in Shanghai, Suzhou and Hangzhou; CN South-Guangzhou has points in Guangzhou, Shenzhen and Dongguan; and CN Southwest-Guiyang has points in Guiyang and Chengdu. Huawei also lists six Hong Kong locations, including Equinix HK2 and HK5 and MEGA Tsuen Wan, which are relevant for companies using Hong Kong as a staging point between Mainland China and overseas regions.

AWS China Direct Connect locations serve the Beijing and Ningxia regions, and Alibaba Cloud and Tencent Cloud publish their own access points across the major eastern and southern metros. Confirm the current list with the provider or with AppInChina before committing to a colocation contract, since locations are added and retired.

How Does Implementation Work?

The following sequence uses AWS China as an example. Other providers follow the same pattern with different console terminology.

1. Define the traffic matrix. List every flow that will use the link, with network ranges, ports, direction, peak bandwidth and failure behaviour. Separate flows that must be private from those that can run over authenticated public HTTPS and from those that should not cross the border at all. This document drives every later decision.
2. Lock the endpoints. Confirm which China region and VPC the connection lands in and which overseas region or VPC it needs to reach. Open the AWS China account if you do not have one; AppInChina handles this under its entity for companies without a Chinese business licence.
3. Request the connection. In the AWS China console, create a Direct Connect connection, selecting the location and port speed. AWS issues an LOA authorising the cross-connect at that facility.
4. Provision the physical circuit. Engage the carrier to deliver a circuit from your premises to the Direct Connect location and complete the cross-connect using the LOA. If the link is cross-border, the carrier also provisions the international segment. AppInChina coordinates with China Telecom, China Unicom and China Mobile on clients’ behalf and negotiates pricing through its partnerships. Lead times are typically several weeks.
5. Configure virtual interfaces. Create a private virtual interface to reach your VPC, and a public virtual interface if you need to reach the provider’s public services such as object storage over the private link. Configure BGP and advertise only the private ranges in your traffic matrix. Never advertise a default route; doing so pulls public traffic into the private path and is very difficult to debug.
6. Set up a gateway for multi-region reach. If the China link needs to reach several overseas VPCs, create a Direct Connect Gateway so that one physical connection can serve multiple regions.
7. Add redundancy. For production workloads, provision a second connection at a different location or carrier, or configure an IPsec VPN over the internet as a documented backup path. Test failover by disabling the primary circuit before go-live.
8. Test and monitor. Validate throughput and latency with production-like payloads, check MTU and application timeouts under loss, and set up latency and packet-loss monitoring with alert thresholds. Record circuit IDs, attachment IDs, prefix lists and route diagrams as handover documentation.

Both the cloud-side port and the carrier-side circuit must be complete before the link is usable. A common source of delay is treating one as launch-ready when the other is still pending.

What Performance Improvement Can You Expect?

Dedicated connections remove the two main causes of poor cross-border performance: contention for limited international bandwidth at peak hours, and deep packet inspection at the border. AppInChina’s project experience suggests typical latency reductions of roughly 40 per cent on North America and Europe to China routes and more on intra-Asia routes, with packet loss falling from the 2 to 8 per cent range common on public internet paths to well under 1 per cent. Throughput also becomes consistent across the day rather than degrading at peak hours.

These figures are illustrative estimates drawn from past implementations. Actual results depend on the locations chosen, the carrier’s routing, port speed and whether the link is domestic or cross-border. Measure your own baseline before implementation so that improvement can be quantified.

What Compliance Considerations Apply?

Direct Connect improves control over how data moves, but it does not exempt a company from China’s data rules. Three points deserve attention.

Cross-border data transfer. The Personal Information Protection Law (个人信息保护法) requires companies transferring personal information out of China to meet one of the statutory conditions in Article 38, such as a CAC security assessment, certification or the standard contract, and Article 40 requires critical information infrastructure operators and large-volume processors to store personal information domestically. Article 37 of the Cybersecurity Law (网络安全法) and Article 31 of the Data Security Law (数据安全法) impose parallel obligations for important data. A private circuit changes the route, not the legal status of the transfer. Data that would need an assessment over the public internet still needs one over Direct Connect.

Security assessment of the systems involved. Systems hosted in China are subject to MLPS classification and filing. A Direct Connect link extends the network boundary of those systems and should be reflected in their security documentation.

Telecommunications licensing. Cross-border circuits and international data channels are regulated services in China and can only be provided by licensed carriers. Companies should use the carriers’ official products rather than informal alternatives, both for legal reasons and because unlicensed paths can be disrupted without notice.

Private does not mean trusted. Identity, encryption and network segmentation should remain in place so that a compromised host on one side of the link cannot reach the other side freely.

How Long Does Direct Connect Take and What Does It Cost?

A straightforward domestic connection to a China region typically takes one to two months from assessment to production, including account setup, carrier provisioning and testing. Cross-border links and redundant designs generally take longer, and AppInChina’s SaaS performance guide places the full infrastructure layer at two to six months when account opening, ICP Filing and multi-carrier coordination are all involved. Carrier lead times alone are measured in weeks and are the usual bottleneck.

Costs fall into two categories. The cloud provider charges port hours and data transfer, published in each provider’s pricing calculator (AWS China, Azure China, Huawei Cloud). The carrier charges monthly or annual circuit fees, which vary by distance, bandwidth and whether the circuit crosses the border. Combined monthly costs for a production link commonly fall in the low to mid thousands of US dollars and rise with bandwidth and redundancy; treat this as a planning range rather than a quote. Carrier pricing is negotiable, and AppInChina obtains reductions through its relationships with China Telecom, China Unicom and China Mobile.

FAQs

Will Direct Connect Make my Website Load Faster in China?

No. Direct Connect connects your own infrastructure privately. Public visitors reach your website over the Chinese public internet, so website performance depends on Mainland hosting or CDN, ICP Filing and China-compatible third-party services.

Can I Use my Global AWS or Azure Account for Direct Connect in China?

No. China regions are operated separately with their own accounts, credentials and billing. You need a Mainland China cloud account, which requires a Chinese entity or a partner such as AppInChina.

Do I Need an ICP Filing for Direct Connect?

Not for the link itself. You need an ICP Filing if the China-side resources include a public-facing website or online service, and that requirement applies regardless of how the back end is connected.

Which Carriers Provide the Service?

Licensed Chinese carriers, principally China Telecom, China Unicom and China Mobile, sometimes through neutral colocation operators. The cloud provider supplies the port and LOA (Letter of Authorization); the carrier supplies the circuit.

Does Direct Connect Remove the Need for a Cross-border Data Transfer Assessment?

No. PIPL, the Cybersecurity Law and the Data Security Law apply to the data being transferred, not to the route it takes. A private circuit gives you better control and audit trails but does not change the legal obligation.

Do I Need a Backup Connection?

For production workloads, yes. Cross-border segments fail. A second circuit at a different location or carrier, or a VPN over the internet as a documented degraded mode, prevents a single failure from becoming an outage.

How is Direct Connect Different from a CDN?

A CDN caches public content close to end users and requires an ICP Filing for Mainland nodes. Direct Connect is a private link between your own systems. They address different problems and are often used together.

How Can AppInChina Help?

AppInChina is an official partner of AWS China and Tencent Cloud and has enabled Direct Connect for international companies operating hybrid architectures in China. We can help with:

• Architecture assessment. We review your traffic flows, separate what belongs on a private link from what needs a public China path, and recommend the provider and locations that fit your existing infrastructure.
• China cloud account setup. We open and manage AWS China, Alibaba Cloud or Tencent Cloud accounts under our Chinese legal entity so that you can use Direct Connect without incorporating in China.
• Carrier coordination. We work with China Telecom, China Unicom and China Mobile to provision the physical circuit and cross-connect, and use our partnerships to negotiate pricing and terms.
• Compliance. We obtain the ICP Filing, PSB Filing and MLPS Filing for the China-side systems and advise on cross-border data transfer requirements.
• Ongoing technical support. We support deployment, testing and monitoring, and remain the local point of contact for carrier and cloud provider issues after go-live.
• The rest of the stack. Where the underlying goal is a SaaS product that performs well for Chinese users, we also handle the public-facing layers: China hosting, CDN configuration and website or application localisation.

To find out whether Direct Connect is the right solution for your China infrastructure and what it would take to implement, contact us for an assessment.