From the client to the VPN host it's feasible to do protocol/port identification and prevent it that way. Some are significantly more difficult to do that for though, particularly when it uses something like HTTPS to blend in with the general flow. It's possible to set up a national level proxy gateway, but that would require a user's system to trust some alternate CA which would be really hard to enforce.

Short version, there's always a way around, but they can make it real tough for the average user.