If IPSEC is not natively blocked then I stand corrected, but my experience and that of my other contacts using s variety of different VPN types, corporate or otherwise has been that IPSEC has not worked for a long time unless you have a VPN that is approved/licenced by the authorities.

I agree much of the intelligence of the GFW is pattern matching traffic on any port.