The GFW does block certain ports, including the default OpenVPN ports. Additionally, starting from the end of 2012, deep packet inspection is being performed to block both TCP and UDP connections using OpenVPN. I'm not sure if this also applies to connections using a CA instead of pre-shared keys; I read that these might have a different signature, but I have not verified this myself.
Examples of VPN software that were not affected by the deep packet inspection last time I checked:
- QuickTun: UDP based, a bit hard to setup and does not handle IP changes well
- ShadowSocks: Uses TCP socks connections
- ssh tunnels
- Any custom solution that obfuscates the traffic to prevent detection (some commercial VPN providers wrap OpenVPN connections in a proprietary obfuscation layer)
Additionally, some networks appear to use statistical analysis to detect and break connections that might be VPNs (long connections with a lot of bidirectional traffic?), although I have not seen conclusive evidence for this. It might be meant to block P2P traffic.
Do note that the GFW is a decentralized system and varies from location to location and from provider to provider. You luck may vary.