I think that theres evidence they are already doing packet inspection and active interrogation for anything they deem suspicious. So if your SSH tunnel has some

I think that theres evidence they are already doing packet inspection and active interrogation for anything they deem suspicious. So if your SSH tunnel has some recognizable traffic characteristics, it's game over. There is an option to configure OpenVPN with a fixed key that it uses to encrypt all and any traffic, leaving only random data. That's very desirable right now since there are no easy ways to detect it, but in the future I guess they'll just outright block any traffic that is just too random. Real plaintext traffic, certainly with verbose 1980 protocols like HTTP, trivially fails many randomness tests.