If they block IPs, and closely monitor outgoing tunnels? Then it's a lot harder to get out.
I suspect you're right, they'll probably just block DNS and the worst IPs. It's easier, and DNS gets the 99%. Even The Great Firewall only blocks the 'worst' IPs (like Twitter).