Following further research I've concluded it's not possible to block X-VPN and other stealth VPNs by simple port blocking.  They use encryption techniques to send their control traffic over other protocol channels such as SMTP, which you simply cannot block without causing yourself some loss of service and onconvenience.  A much more sophisticated packet filtering capability is required, only found in high-end routers. A school or business might be able to afford one but not me at home.

Ref. https://unit42.paloaltonetworks.com/evasion-of-security-policies-by-vpn-clients-poses-great-risk-to-network-operators/

Basically, we are screwed, there are no viable packet filtering parental controls anymore.  Best bet is to enrol your child's android phone in sonething like Google family, and lock it down before they get the chance to install anything. 

@Autumn13 disable PPP Connection.

@Colubrid 

I have the AC4000 Wi-fi Router. My I child know how to use VPN and browse using the websites using VPN connestions. I would like to know how block the VPN connections. I see that disabling PPP Connections worked for you. I didn't see any PPP settings on my router guide. Can you please help to share the steps on how to disable?

@Zaphod66 how do you do that? I have an Archer (AC7) 

@AshAsh tell me the procedure how to block when i know the mac address.