Comment by Ballas

Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through.

SSH is also exempt...