OpenVPN in TCP mode wrapped around Stunnel. That’s the thing that works.

I have it set up to bypass VPN restrictions in some networks, but it also serves to bypass a lot more stuff if you know what you’re doing.

DPI will only see TLS traffic, and assume it’s HTTP. You can even try to fool it by modifying the packet headers, so dumb enough DPI will think you’re connecting to the site you choose.