Yes. DPI (Deep Packet Inspection) can occur on network boundaries and filter out traffic on practically anything you can imagine. Blocking VPN IPSec traffic is

Yes. DPI (Deep Packet Inspection) can occur on network boundaries and filter out traffic on practically anything you can imagine. Blocking VPN IPSec traffic is easy. Note, it probably requires installing or configuring network bottlenecks for filtering. Getting the topology correct is harder than the actual filtering, which is a standard feature on enterprise and isp networking hardware. State of the Art is the Chinese GFW -- it can do things like: * look for keywords in tcp packets and reset connections * block whole protocols based on attributes (such as encryption parameters), Tor is always playing cat and mouse here and generally blocked * detect if an encrypted ssh session is being used to tunnel traffic, and reset the connection at both sides with a TCP Reset flag. * modify http traffic to send malicious js to browsers to attack other servers