There are lots of companies selling data, just one of them is a list of known VPN IP addresses. Updated every X days. Just plug that into your service and it gets a lot harder, but still not impossible, to use with a VPN.

It will just be a few approved sites that you are allowed to visit, and just by chance those sites are the ones that pay the goverment the most! Those sites will have records in the approved DNS, that you can not change. Other DNS requests are blocked, along with everything else that isn’t approved.