An SSL based VPN can be done within a UDP wrapper. The outer layer can't be encrypted or the connection wouldn't work. It's the payload that carries your (TCP/UDP) traffic out at the other end of your VPN.