I'm sure all of these boxes come pre-configured with a VPN Service, but all the standard protocols can still be detected with Deep Packet Inspection, something I've seen AT&T do (and block) pretty effectively. I guess there area always the StealthVPN/Chameleon providers out there that try and mask the signature of "what" is going over the VPN - but enough of that and I'm sure they'll nix those connections as well.