Attached below is a Wireshark trace I obtained by sniffing my own network traffic.

I want to draw your attention to this part in particular:

Underneath "User Datagram Protocol", you can see the words "OpenVPN Protocol". So anyone who sniffs my traffic on the wire can see exactly the same thing that I can. While they can't read the contents of the payload, they can tell that it's OpenVPN traffic because the headers are not encrypted. So if a router wanted to block OpenVPN traffic, all they would have to do is drop this packet. It's a similar story for Wireguard packets. An attacker can read the unencrypted headers and learn

• The size of the transmission
• The source and destination IP addresses by reading the IP header
• The source and destination ports numbers by reading the TCP or UDP headers
• The underlying layers, up until the point it hits an encrypted protocol (such as OpenVPN, TLS, or SSH)