Are Your Site-Cluster IPs Reachable from Mainland China? Test, Diagnose and Replace Problem IPs

A site-cluster IP that cannot be reached from mainland China makes every site on it invisible to Chinese visitors and search engines, even though it works perfectly from abroad. IPs can become unreachable because of a previous user's history, filtering of a whole range, a single port or domain being blocked, or a carrier routing problem. This guide shows how to test reachability from several Chinese locations, tell these cases apart, check a whole IP block in bulk, and move sites off a problem IP quickly.

Step 1: Test from Many Chinese Locations

Online multi-location test services (for example ITDOG, 17CE, Boce or Chinaz) run ping, TCP port and HTTP tests from dozens of locations on China Telecom, China Unicom and China Mobile. For each problem, run three tests:

• Ping the IP: basic reachability.
• TCP test of the IP on ports 80 and 443: whether the web service is reachable.
• HTTP test of the domain: whether the site itself loads.

Step 2: Read the Pattern

Step 3: Check the Domain for DNS Problems

Compare the answers of a public resolver and a mainland Chinese resolver. Repeat the query a few times: if the Chinese resolver returns addresses that have nothing to do with your server, the domain is affected and moving the site to another IP will not help.

dig +short example.com A @1.1.1.1
dig +short example.com A @114.114.114.114
dig +short example.com A @223.5.5.5

Step 4: Test a Whole Block in Bulk

To check every IP of a /24 at once, run a small script on a machine located in mainland China (a low-cost cloud server or an office computer is enough). It tests TCP 80 and 443 on each IP and lists the ones that fail.

# ips.txt: one IP per line (generate with: for i in $(seq 2 254); do echo 203.0.113.$i; done > ips.txt)
cat > check-ips.sh <<'EOF2'
#!/bin/bash
while read -r ip; do
  r80=$(timeout 4 bash -c "</dev/tcp/$ip/80" 2>/dev/null && echo ok || echo FAIL)
  r443=$(timeout 4 bash -c "</dev/tcp/$ip/443" 2>/dev/null && echo ok || echo FAIL)
  echo "$ip 80:$r80 443:$r443"
done < ips.txt | tee result-$(date +%F).txt | grep FAIL
EOF2
chmod +x check-ips.sh && ./check-ips.sh

An IP only answers on ports where something is listening, so run this against IPs that have a site (or at least Nginx's default server) bound to them. Compare the result with the same test from a server outside China to separate real reachability problems from IPs that simply have no service.

Step 5: Collect Evidence for Your Provider

Routing problems can often be fixed by the provider. Collect:

# From the server towards major Chinese resolvers (apt install mtr-tiny / dnf install mtr)
mtr -rwc 50 114.114.114.114
mtr -rwc 50 223.5.5.5

# From the machine in China towards your server
mtr -rwc 50 203.0.113.10

Save screenshots of the multi-location tests with the time of the test. For route analysis, see return route tests to China and connectivity troubleshooting with ping, tcping and mtr.

Step 6: Move Sites off a Problem IP

1. Pick a spare IP from your block that passed the tests in Step 4.
2. Change the site's IP in your mapping file and Nginx configuration (with the setup from deploying sites on a multi-IP server, edit sites.txt and run the deploy script), then reload Nginx.
3. Update the domain's A record. Lower the TTL to 300 seconds in advance if you expect to move sites often.
4. Re-test the new IP and the domain from several Chinese locations.

Keep a list of tested, unused IPs ready so you can move a site within minutes, and re-test the old IP after some time before reusing it. Also review the site's content: sites with content that is not permitted in China will be affected again on any IP.

Step 7: Monitor Continuously

Run the bulk check from Step 4 daily from your Chinese machine with cron, and send yourself the list of failures, or monitor key sites with Uptime Kuma running on that machine (see monitoring with Uptime Kuma). Spreading sites over several /24 blocks limits the impact when one range has problems (see multi-C-class site-cluster servers).

FAQ

The IP works from abroad but not from China. Is my server down?

No. The server is running; the path from China to it is not working. Follow Steps 1 to 5 to find out whether it is the IP, a port, the domain or a carrier route.

Should I test new IPs before deploying sites?

Yes. Test every new IP from Chinese locations before you put sites on it, and keep only the ones that pass in your deployment list.

Can IMIDC help with an IP that is unreachable from China?

Open a ticket with your test results from several locations and the mtr output from Step 5. We will check the routing for your block and discuss the options with you.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Include the server IP, the affected IPs and domains, screenshots of the multi-location tests and the mtr results so we can pinpoint the issue faster.